Individual skill

web-auth-session-handling

Legitimately acquire and KEEP an authenticated session (through MFA/OTP) so you can test the post-auth attack surface, and hand that session to your tools without leaking secrets. Load when the high-value classes (IDOR/BOLA, mass assignment, injection on real data APIs) are blocked behind login/SMS-OTP/TOTP, when tokens keep expiring mid-test, or when Burp/Playwright keep logging you out. Distinct from attacking auth — this one authenticates and reuses the session.

skills/web/web-auth-session-handling/SKILL.md

Read pinned source

Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Instructions only
Last checked: Nov 11, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 27
Repository last updated: Oct 14, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai-agents Repository topic
ai-security Repository topic
application-security Repository topic
blue-team Repository topic
bug-bounty Repository topic
claude-code Repository topic
codex Repository topic
detection-engineering Repository topic
gemini Repository topic
testing Derived category
data Derived category
testing-browser Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 4,683 bytes

Read excerpt


# Authenticated session handling

## When it applies
The interesting bugs live *after* login — cross-tenant IDOR/BOLA, mass assignment, injection on
the real data APIs — but the run keeps collapsing to pre-auth findings because login is gated by
MFA/OTP, or the token expires and every automated request 401s halfway through. This skill is the
setup step that makes authenticated testing actually work. It does **not** attack the auth
mechanism (`web-oauth`, `web-auth-jwt`, `api-auth-attacks` do that) — it obtains one legitimate
session and keeps it usable.

## Why it works
Post-auth coverage silently disappears when tooling can't hold a session: the scanner logs out,
the token lapses, or MFA can't be satisfied autonomously. Capturing the session as a *reusable
artifact* — the cookie/localStorage state for browser-driven testing and the raw bearer token for