← all domains
5 skills

Auth & Identity

OAuth 2.0 flows, JWT attacks, ATO chains, SAML bypasses, and MFA bypass techniques drawn from 19–40 disclosed reports each.

/hunt-oauthBoth ✓
OAuth Hunter
OAuth 2.0 and OIDC vulnerabilities — CSRF on redirect_uri, state fixation, code injection, token leakage, and open redirect chains. Built from 19 reports.
19 reports
/hunt-atoBoth ✓
ATO Hunter
Account takeover chains — password reset poisoning, username enumeration, token predictability, and session fixation patterns.
/hunt-auth-bypassBoth ✓
Auth Bypass Hunter
Authentication bypass — JWT alg=none, weak HMAC secrets, path traversal in auth middleware, and HTTP verb override bypass.
/hunt-mfa-bypassBoth ✓
MFA Bypass Hunter
Multi-factor authentication bypass — code reuse, race conditions on OTP validation, backup code enumeration, and SIM-swap-adjacent flows.
/hunt-samlBoth ✓
SAML Hunter
SAML SSO vulnerabilities — signature wrapping, XML comment injection, NameID manipulation, and SP-initiated flow abuse.

Ready to install your first skill? Start in minutes.

Browse all 8 attack domains — 51 specialized skills, MIT licensed.

Browse all 8 domainsRead the install guide

Works with Claude Free, Pro, Teams, and Enterprise · MIT License