Escalate Auth Bypass
Turn a suspected or confirmed authentication/authorization bypass into impact, admin...
Install
npx skills add vigolium/vigolium --skill escalate-auth-bypass -g -a claude-code -y- Repository
- vigolium/vigolium1.1k
- Category
- Engineering
- Updated
- 10d ago
- License
- MIT
- Context cost
- Lightabout 1,348 tokens
- Runs scripts
- No, instructions only
What it does
Turn a suspected or confirmed authentication/authorization bypass into impact, admin access, session takeover, privilege escalation, or cross-tenant read. Use when you find a missing auth check on a route, a weak JWT verifier, a session cookie that's predictable or reusable across users, a privilege field client-controllable, or an audit finding tagged CWE-287/CWE-863/CWE-639. Walks from probe to admin-equivalent capability and persists a finding with the highest-impact action you reached.
Auth Bypass → Impact Escalation
You have a suspected auth weakness. Your job is to turn it into the strongest impact you can demonstrate, admin access, cross-tenant data read, token forgery, or session takeover, and persist a finding with the specific action that proves it. Reporting "missing auth check" without showing what it gets you is not a finding.
When this skill applies
- A route responds 200 with no
Authorization/ session cookie when it should require auth (compare to a known-auth'd record's response). - JWT verification accepts
alg: none, a key-confused HMAC secret, or a token signed with the public key as HMAC secret. - A session ID is predictable (sequential, time-based, or short).
- A request body / query has a role/tenant/user field that, when changed,
changes the response (
role=user→role=admin,tenant=A→tenant=B). - Audit harness flagged CWE-287, CWE-862, CWE-863, CWE-639, CWE-284, or CWE-639, even theoretical.
Workflow
1. Establish baselines
Use list_auth_sessions to see which auth contexts already exist for the
host. Use auth_session_lookup to pull the actual headers for at least
two roles if you have them (anon + user is enough; user + admin
is ideal). remember the role boundaries as auth-roles.
If only one role is available, use query_records to find an
unauthenticated record for the same endpoint to anchor the no-auth
baseline.
2. Classify the weakness
Pick one mechanism to attack, don't shotgun:
