A specialized security testing skill designed to identify authentication bypass vulnerabilities and account takeover risks.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install pentest-auth-bypass
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install pentest-auth-bypass using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Pentest Auth Bypass?
Pentest Auth Bypass is a rigorous security assessment tool within the Openclaw Skills ecosystem, specifically engineered to test the strength of authentication and session management controls. It provides a structured framework for validating how applications handle login attempts, session persistence, and Multi-Factor Authentication (MFA). By leveraging Openclaw Skills, security researchers can automate the detection of account takeover scenarios while adhering to industry-standard methodologies.
The skill is built to align with professional frameworks such as PTES and OWASP WSTG, ensuring that security audits are both comprehensive and compliant. It acts as a critical component for developers and security engineers using Openclaw Skills to build resilient defense mechanisms against unauthorized access.
Pentest Auth Bypass Use Cases
- Validating the effectiveness of Multi-Factor Authentication (MFA) enforcement across various endpoints.
- Testing the resilience of login forms against automated brute-force and credential stuffing attacks.
- Auditing session management to identify vulnerabilities like session hijacking, fixation, or improper invalidation.
- Generating structured findings and reproducible proof-of-concept notes for security remediation teams.
How Pentest Auth Bypass Works
- The skill begins by performing a mandatory scope validation to ensure all testing actions are restricted to authorized targets.
- It initializes authorized security checks based on NIST SP 800-115 and MITRE ATT&CK techniques (T1110, T1550).
- Users must provide an explicit authorization flag to move beyond dry-run mode, ensuring safety in production environments.
- The tool executes targeted scripts to simulate authentication bypass attempts and analyze session behavior.
- Deterministic artifacts are generated and exported in standardized JSON formats for integration with other Openclaw Skills.
Pentest Auth Bypass Setup
To get started with this skill, ensure your environment is prepared for Python execution and you have the necessary scope definitions ready.
# Navigate to the skill directory
cd skills/pentest-auth-bypass
# Run a dry-run execution to validate your scope and configuration
python scripts/auth_bypass.py --scope scope.json --target <target_url> --input <input_path> --output <output_path> --format json --dry-run
# Execute with explicit authorization for live testing
python scripts/auth_bypass.py --scope scope.json --target <target_url> --i-have-authorization
Pentest Auth Bypass Data Schema & Taxonomy
This skill utilizes a structured data approach to ensure findings are actionable and compatible with the broader Openclaw Skills ecosystem.
| Artifact | Description |
|---|---|
auth-findings.json |
Contains identified vulnerabilities mapped to the canonical finding_schema. |
valid-sessions.json |
A record of session integrity data and captured tokens for analysis. |
auth-attack-report.json |
A high-level summary of the attack vectors tested and the overall security posture. |
Pentest Auth Bypass Advanced Features
- Full integration with PTES Stage 5 and MITRE ATT&CK mapping for professional-grade reporting.
- Support for the canonical finding_schema, allowing for seamless data exchange between different Openclaw Skills.
- Mandatory dry-run mode and safety flags to prevent accidental execution on unauthorized infrastructure.
- Deterministic artifact generation designed for downstream consumption by automated remediation agents.
SKILL.md
Loading
Related Openclaw Skills
Pentest API Attacker
A professional security testing skill designed to enumerate and audit API endpoints against the OWASP API Security Top 10.
Pentest Active Directory
An automated security assessment tool for mapping and validating Active Directory identity attack paths and privilege escalation routes.
Nmap Pentest Scans
Orchestrate authorized Nmap host discovery, service enumeration, and automated security reporting.
ML Model Evaluation & Benchmarking
A technical tool for producing consistent model rankings from metric-weighted evaluation inputs and deterministic benchmarking logic.
Pentest C2 Operator
A specialized tool for managing authorized Command and Control simulation workflows and measuring defensive detection effectiveness.
ohmytoken
A real-time AI spending tracker that visualizes LLM token consumption as interactive, customizable pixel art bead boards.
Featured*
