Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-athn-11
Testing Multi-Factor Authentication (MFA)
Passed 20 of 22 test cases with the skill, and 14 of 22 without it.
and 6 more in the full report
6 fixed14 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
Specify the rate limiting parameters (maximum attempts allowed and lockout duration) recommended for protecting numeric OTP verification endpoints against brute-force attacks.
| Checked | Without skill | With skill |
|---|---|---|
| The rate limiting policy specifies a strict maximum attempt limit of 5 attempts. | Missed | Passed |
| The rate limiting policy enforces a lockout duration of 15 minutes upon exceeding maximum attempts. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-ATHN-11
Testing Multi-Factor Authentication (MFA)
Multi-Factor Authentication adds an additional layer of security beyond passwords. This test examines the implementation of MFA for weaknesses such as bypass vulnerabilities, weak OTP generation, lack of rate limiting, and improper enrollment procedures. A flawed MFA implementation can give users false confidence while not actually providing meaningful protection.
| Weakness | Description |
|---|---|
| Direct page access | Bypass MFA by accessing post-auth pages |
| Response manipulation | Change response to indicate MFA success |
| Brute force OTP | No rate limiting on attempts |
| Weak OTP generation | Predictable codes |
| Backup code reuse | Codes not single-use |
test cases passed, vs 14 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.