Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-athn-04
Testing for Bypassing Authentication Schema
Passed 17 of 22 test cases with the skill, and 16 of 22 without it.
2 fixed15 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
Can you help me design an assessment procedure for testing web application authentication resistance against parameter manipulation, cookie spoofing, and SQL injection in login forms? Format the response as a step-by-step technical guide including curl command examples for each vector, mapped CWE references, and secure coding fixes for Flask applications.
| Checked | Without skill | With skill |
|---|---|---|
| Includes curl commands demonstrating HTTP requests for testing direct access. | Passed | Passed |
| Maps authentication bypass vulnerabilities to CWE-287. | Missed | Passed |
| Demonstrates parameterized query implementation using SQLAlchemy filter_by. | Passed | Passed |
The instructions your model reads when the skill loads.
WSTG-ATHN-04
Testing for Bypassing Authentication Schema
Authentication bypass testing examines whether an application's authentication controls can be circumvented. Attackers may exploit logic flaws, misconfigurations, or vulnerabilities to access protected resources without proper authentication. This test identifies weaknesses that allow unauthorized access by bypassing the normal authentication process.
| Vulnerability | Description |
|---|---|
| Forced browsing | Direct URL access to protected pages |
| Parameter tampering | Modifying auth parameters |
| Cookie manipulation | Changing session/auth cookies |
| SQL injection | Auth bypass via SQLi |
| JWT manipulation | Token tampering |
test cases passed, vs 16 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.