Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-auth-session
WSTG identity, authentication, authorization, and session management testing
Passed 20 of 22 test cases with the skill, and 18 of 22 without it.
2 fixed18 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
How can bash and curl be combined to iterate through numeric user IDs from 1 to 20 while printing only the HTTP status code for each request?
| Checked | Without skill | With skill |
|---|---|---|
| Uses curl -w with %{http_code} inside a bash seq loop. | Missed | Passed |
The instructions your model reads when the skill loads.
Test login, registration, and password reset with known vs unknown usernames:
# Login form — compare responses
curl -s -X POST https://TARGET/login -d "user=admin&pass=wrong" -o resp_valid.txt
curl -s -X POST https://TARGET/login -d "user=nonexistent&pass=wrong" -o resp_invalid.txt
diff resp_valid.txt resp_invalid.txt
# Check response timing differences
time curl -s -X POST https://TARGET/login -d "user=admin&pass=wrong" > /dev/null
time curl -s -X POST https://TARGET/login -d "user=fake12345&pass=wrong" > /dev/null
# Registration endpoint
curl -s -X POST https://TARGET/register -d "user=admin&[email protected]"
# Look for: "username already taken" vs generic error
# Password reset
curl -s -X POST https://TARGET/forgot -d "email=admin@TARGET"
# Look for: "email sent" vs "email not found"
ffuf -u https://TARGET/login -X POST -d "username=FUZZ&password=test" \
-w /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
-H "Content-Type: application/x-www-form-urlencoded" \
-fr "Invalid username" -mc all
| Username | Password | Common On |
|---|
test cases passed, vs 18 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.