SKILL: Authentication Bypass, Expert Attack Playbook

AI LOAD INSTRUCTION: Expert authentication bypass techniques. Covers SQL injection-based login bypass, password reset flaws, token predictability, account enumeration, brute force bypass, and multi-factor auth bypass. Distinct from JWT/OAuth (covered in ../jwt-oauth-token-attacks/SKILL.md). Focus on the login mechanism itself.

0. AUTHORIZED CREDENTIAL TEST PLANNING

After reducing routing entries, default credentials, username variants, port focus, and wordlist sizing are handled here in one place.

Service-first tiny sets

Service Type	First Usernames	First Passwords
phpMyAdmin	root, admin	empty, root, phpmyadmin, admin
FTP	ftp, admin, test	empty, ftp, admin, 123456
SSH	root, admin, service account names	root, admin, seasonal variants
MySQL	root, mysql	empty, root, mysql
Tomcat / Java admin	tomcat, admin, manager	tomcat, admin, s3cret
WebLogic	weblogic, admin	weblogic, welcome1, admin

Username classes

Class	Examples
Generic admins	admin, administrator, root, test, guest
Support / ops	dev, ops, sysadmin, service, backup
Name-based	firstname, lastname, f.lastname, first.last
Mail-derived	left side of corporate email formats
Product-based	tomcat, weblogic, jenkins, gitlab

Wordlist sizing and port focus

Scenario	Preferred Size	Why
Default admin panel	5 to 50 passwords	Defaults beat giant lists here
Internal service with known product	vendor-specific small set	Better signal than generic lists
Consumer login with weak controls	Top 20 or Top 100	Fast verification
Rate-limited login	tiny list + header/rotation strategy	Preserve attempts
Offline hash cracking	large dictionaries	Online brute rules do not apply