# Authentication

> Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.

- **Type:** Skill
- **Install:** `agentstack add skill-transilienceai-communitytools-authentication`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [transilienceai](https://agentstack.voostack.com/s/transilienceai)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [transilienceai](https://github.com/transilienceai)
- **Source:** https://github.com/transilienceai/communitytools/tree/main/skills/authentication
- **Website:** https://www.transilience.ai/

## Install

```sh
agentstack add skill-transilienceai-communitytools-authentication
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Authentication

Test authentication mechanisms including login security, token handling, 2FA, CAPTCHA, and bot detection.

## Techniques

| Type | Key Vectors |
|------|-------------|
| **Auth Bypass** | Default credentials, logic flaws, response manipulation |
| **ADFS/SAML** | Golden SAML, token signing cert theft, assertion manipulation, SAML wrapping |
| **JWT** | Algorithm confusion, key injection, claim tampering, token forging |
| **OAuth** | Redirect manipulation, CSRF, token leakage, scope abuse |
| **Password** | Brute force, credential stuffing, password policy bypass |
| **2FA Bypass** | Response manipulation, direct endpoint access, code reuse, race conditions |
| **CAPTCHA Bypass** | Missing server validation, token reuse, OCR, parameter manipulation |
| **Bot Detection** | Behavioral biometrics simulation, fingerprint randomization, stealth mode |

## Tools

**PasswordGenerator** (`tools/password_generator.py`):
```python
from tools.password_generator import generate_password
password = generate_password(hint_text="8-16 chars, uppercase, numbers")
```

**CredentialManager** (`tools/credential_manager.py`):
```python
from tools.credential_manager import CredentialManager
mgr = CredentialManager()
mgr.store_credential(target="example.com", username="test", password="pass")
```

## Workflow

1. Analyze auth implementation (forms, tokens, 2FA, CAPTCHA)
2. Test bypass vectors per technique type
3. Use Playwright MCP with human-like behavior (typing 80-200ms, random pauses)
4. Capture evidence (screenshots, network logs, tokens)
5. Document findings with PoC scripts

## Reference

- `reference/authentication*.md` - Auth bypass techniques, payloads, and resources
- `reference/jwt*.md` - JWT attack techniques and cheat sheets
- `reference/oauth*.md` - OAuth vulnerability testing
- `reference/scenarios/password-attacks/*.md` - Password attack vectors (spray, stuffing, cracking, PtH)
- `reference/adfs-exploitation.md` - ADFS, Golden SAML, federation attacks
- `reference/scenarios/2fa/*.md` - 2FA bypass methods
- `reference/CAPTCHA_BYPASS.md` - 11 CAPTCHA bypass techniques
- `reference/BOT_DETECTION.md` - Bot detection evasion strategies
- `reference/PASSWORD_CREDENTIAL_MANAGEMENT.md` - Tool usage guide

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [transilienceai](https://github.com/transilienceai)
- **Source:** [transilienceai/communitytools](https://github.com/transilienceai/communitytools)
- **License:** MIT
- **Homepage:** https://www.transilience.ai/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-transilienceai-communitytools-authentication
- Seller: https://agentstack.voostack.com/s/transilienceai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.