mcpField
P
pentest-authentication-authorization-review

pentest-authentication-authorization-review

github.com/crtvrffnrtSecurity463 installsUpdated 5w ago
Repository

About pentest-authentication-authorization-review

pentest-authentication-authorization-review is a security testing skill for reviewing identity, sessions, tokens, and authorization boundaries. It structures paired-role tests and evidence, and defines handoffs for deeper access-control analysis or report synthesis.

Key features

  1. 01Role-to-action access-control matrix
  2. 02Session and token lifecycle checks
  3. 03Horizontal and vertical boundary tests
  4. 04Object, function, and workflow authorization checks
  5. 05Evidence for allowed and denied paths
  6. 06Criteria for specialist handoffs

Use cases

  1. 01Testing token revocation and replay behavior
  2. 02Comparing access across user roles
  3. 03Separating authentication and authorization failures

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/crtvrffnrt/skills --skill pentest-authentication-authorization-review

After installing, type/pentest-authentication-authorization-reviewin Claude Code to confirm it loaded.

Details

From the project README

Authentication & Authorization Review

Use When

  • Session replay, token lifecycle, MFA behavior, account takeover, tenant isolation, or identity-boundary validation is the main question.
  • The task needs paired-role testing for object, function, or workflow authorization.
  • The next step is to distinguish authentication failure from authorization failure.

Handoff Criteria

  • Hand off to pentest-advanced-access-control-auditor for a deep IDOR, BOLA, BFLA, RBAC, or ownership test matrix.
  • Hand off to pentest-input-protocol-manipulation when parser behavior or request mutation becomes the owner blocker.
  • Hand off to pentest-evidence-structuring-report-synthesis when live validation is complete.

Output Schema

  • Access-control matrix: actor, resource, action, expected, observed
  • Session/token lifecycle findings: issued, replayed, revoked, result
  • Confirmed boundary breaks with attacker capability statement

Instructions

  1. Define identity roles and expected permissions before testing.
  2. Validate both horizontal and vertical boundaries with paired-role comparisons.
  3. Test session and token invalidation across interfaces and time windows.
  4. Confirm authorization at object, function, and workflow levels.
  5. Distinguish authentication weakness from authorization weakness in output.
  6. Escalate only confirmed boundary failures into exploit chaining.

Verification Gate

  • Use explicit role-to-action test cases.
  • Capture full evidence for accepted and denied control paths.
  • Verify revocation behavior, not just issuance behavior.
  • Do not infer access-control findings from UI behavior alone.
  • Do not conflate missing data with denied access.
  • Mark privilege escalation only with deterministic proof of a crossed boundary.

Situational Awareness

  • Cross-check high-impact authz claims with an alternate role, alternate object, alternate method, or alternate interface.
  • Track confirmed, rejected, and unknown role/action pairs separately.

Comments

Markdown supported