# Authenticated Session Acquisition

Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a...

- Repository: https://github.com/transilienceai/communitytools (600 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-07-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add transilienceai/communitytools --skill authenticated-session-acquisition -g -a claude-code -y`
Codex: `npx skills add transilienceai/communitytools --skill authenticated-session-acquisition -g -a codex -y`
Cursor: `npx skills add transilienceai/communitytools --skill authenticated-session-acquisition -g -a cursor -y`
Gemini CLI: `npx skills add transilienceai/communitytools --skill authenticated-session-acquisition -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add transilienceai/communitytools`

## Description

Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface. Use when the highest-value authenticated classes (BOLA/IDOR/mass-assignment/injection on the real data APIs) are blocked because login is gated by SMS-OTP or TOTP MFA. Distinct from the authentication skill (which ATTACKS auth); this one legitimately authenticates and hands the session to the rest of the engagement.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Authenticated Session Acquisition

On financial and multi-tenant targets the login is gated by SMS OTP / TOTP MFA that an autonomous run cannot satisfy, so the post-auth surface (BOLA/IDOR/mass-assignment/injection on the real data APIs, session handling, API pivots) silently collapses to pre-auth findings only. This skill's job is narrow and concrete: **get one legitimate authenticated session and hand it to the executors as a reusable artifact.** It does not attack the auth mechanism, see [`authentication`](../authentication/SKILL.md) for that.

## The artifact contract (how the session reaches executors)

Emit both, into the engagement's OUTPUT_DIR, referenced BY NAME (never inline secrets, [`credential-loading.md`](../coordination/reference/credential-loading.md)):

- `OUTPUT_DIR/<asset>/session/storageState.json`, the Playwright storage state (cookies + localStorage) for browser-driven post-auth testing.
- `OUTPUT_DIR/<asset>/session/bearer.txt`, the raw access/ID token (+ its `expires_at`) for direct API replay.

Executors consume these exactly like any env-loaded secret: the scope file's `creds_env` names the realm, and the session path is passed as a file reference, so no token is ever written into a prompt, `experiments.md`, or `attack-chain.md`. Re-run this skill when the token expires (record `expires_at`; refresh rather than re-login where a refresh token exists).

## Modes (pick by what the client can provide)

The rest: https://github.com/transilienceai/communitytools/blob/HEAD/skills/authenticated-session-acquisition/SKILL.md