mcpField
A
authentication

authentication

github.com/transilienceaiSecurity600201 installsUpdated 13w ago
Repository

About authentication

An authentication security testing skill for evaluating login flows, tokens, 2FA, CAPTCHA, and bot detection. It combines attack references with password and credential-management utilities, and outlines evidence capture and reporting.

Key features

  1. 01Authentication bypass testing
  2. 02ADFS, SAML, JWT, and OAuth testing
  3. 03Password and 2FA attack references
  4. 04CAPTCHA and bot-detection testing
  5. 05Password and credential utilities
  6. 06Evidence capture and findings workflow

Use cases

  1. 01Assess login and token-handling weaknesses
  2. 02Test 2FA and CAPTCHA protections
  3. 03Generate passwords and store test credentials
  4. 04Document authentication findings with evidence

MCP support

The workflow specifies using Playwright MCP for authentication testing with human-like interaction behavior.

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/transilienceai/communitytools --skill authentication

After installing, type/authenticationin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

reference/
adfs-exploitation.md
authentication-cheat-sheet.md
authentication-index.md
authentication-principles.md
authentication-quickstart.md
authentication-resources.md
BOT_DETECTION.md
CAPTCHA_BYPASS.md
default-credentials.md
INDEX.md
jwt_security_resources.md
jwt-advanced.md
jwt-quickstart.md
ntlm-http-listener.py
oauth-index.md
oauth-quickstart.md
oauth-resources.md
PASSWORD_CREDENTIAL_MANAGEMENT.md
reference/scenarios/2fa/
backup-codes.md
brute-force-otp.md
code-reuse.md
direct-endpoint-access.md
email-sms-extraction.md
otp-leakage.md
otp-parameter-manipulation.md
predictable-codes.md
race-condition.md
response-manipulation.md
session-pre-2fa.md
reference/scenarios/jwt/
alg-confusion.md

Details

From the project README

Authentication

Test authentication mechanisms including login security, token handling, 2FA, CAPTCHA, and bot detection.

Techniques

TypeKey Vectors
Auth BypassDefault credentials, logic flaws, response manipulation
ADFS/SAMLGolden SAML, token signing cert theft, assertion manipulation, SAML wrapping
JWTAlgorithm confusion, key injection, claim tampering, token forging
OAuthRedirect manipulation, CSRF, token leakage, scope abuse
PasswordBrute force, credential stuffing, password policy bypass
2FA BypassResponse manipulation, direct endpoint access, code reuse, race conditions
CAPTCHA BypassMissing server validation, token reuse, OCR, parameter manipulation
Bot DetectionBehavioral biometrics simulation, fingerprint randomization, stealth mode

Tools

PasswordGenerator (tools/password_generator.py):

from tools.password_generator import generate_password
password = generate_password(hint_text="8-16 chars, uppercase, numbers")

CredentialManager (tools/credential_manager.py):

from tools.credential_manager import CredentialManager
mgr = CredentialManager()
mgr.store_credential(target="example.com", username="test", password="pass")

Workflow

  1. Analyze auth implementation (forms, tokens, 2FA, CAPTCHA)
  2. Test bypass vectors per technique type
  3. Use Playwright MCP with human-like behavior (typing 80-200ms, random pauses)
  4. Capture evidence (screenshots, network logs, tokens)
  5. Document findings with PoC scripts

Reference

  • reference/authentication*.md - Auth bypass techniques, payloads, and resources
  • reference/jwt*.md - JWT attack techniques and cheat sheets
  • reference/oauth*.md - OAuth vulnerability testing
  • reference/scenarios/password-attacks/*.md - Password attack vectors (spray, stuffing, cracking, PtH)
  • reference/adfs-exploitation.md - ADFS, Golden SAML, federation attacks
  • reference/scenarios/2fa/*.md - 2FA bypass methods
  • reference/CAPTCHA_BYPASS.md - 11 CAPTCHA bypass techniques
  • reference/BOT_DETECTION.md - Bot detection evasion strategies
  • reference/PASSWORD_CREDENTIAL_MANAGEMENT.md - Tool usage guide

Comments

Markdown supported