npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Use this skill when:
Tests mobile app API authentication for broken auth, insecure JWTs/OAuth, session fixation, privilege escalation, and IDOR vulnerabilities during security assessments.
Tests mobile app API authentication and authorization for vulnerabilities like auth bypass, insecure JWT tokens, IDOR, privilege escalation, and session flaws. Useful for pentesting Android/iOS backends with Burp Suite or mitmproxy.
Tests API authentication mechanisms for weaknesses like broken JWT validation, missing endpoint auth, weak passwords, credential stuffing, token leakage, and session flaws. Maps to OWASP API2:2023.
Share bugs, ideas, or general feedback.
Use this skill when:
Do not use this skill against production APIs without explicit authorization and rate-limiting awareness.
Intercept mobile app traffic to identify authentication-related endpoints:
POST /api/v1/auth/login - Initial authentication
POST /api/v1/auth/register - Account registration
POST /api/v1/auth/refresh - Token refresh
POST /api/v1/auth/logout - Session termination
POST /api/v1/auth/forgot-password - Password reset
POST /api/v1/auth/verify-otp - OTP verification
GET /api/v1/auth/me - Authenticated user profile
JWT Analysis:
# Decode JWT without verification
echo "eyJhbGciOiJIUzI1NiIs..." | cut -d. -f2 | base64 -d 2>/dev/null
# Check for common JWT vulnerabilities:
# 1. None algorithm attack
# Change header to: {"alg":"none","typ":"JWT"}
# Remove signature: header.payload.
# 2. Algorithm confusion (RS256 to HS256)
# If server uses RS256, try HS256 with public key as secret
# 3. Weak signing key
# Use hashcat or jwt-cracker to brute-force HMAC secret
hashcat -m 16500 jwt.txt wordlist.txt
# 4. Expiration bypass
# Modify "exp" claim to future timestamp
Opaque Token Analysis:
- Test token length and entropy
- Check if tokens are sequential/predictable
- Test token reuse after logout
- Verify token invalidation on password change
# Test missing authentication
curl -X GET https://api.target.com/api/v1/users/profile
# Test with empty/null token
curl -X GET https://api.target.com/api/v1/users/profile \
-H "Authorization: Bearer "
curl -X GET https://api.target.com/api/v1/users/profile \
-H "Authorization: Bearer null"
# Test with expired token (should fail)
curl -X GET https://api.target.com/api/v1/users/profile \
-H "Authorization: Bearer <expired_token>"
# Test token from different user
curl -X GET https://api.target.com/api/v1/users/123/profile \
-H "Authorization: Bearer <user_456_token>"
# Change user ID in request path
curl -X GET https://api.target.com/api/v1/users/123/orders \
-H "Authorization: Bearer <user_456_token>"
# Change object ID in request body
curl -X PUT https://api.target.com/api/v1/orders/789 \
-H "Authorization: Bearer <user_456_token>" \
-d '{"status": "cancelled"}'
# Test horizontal privilege escalation
# Access admin endpoints with regular user token
curl -X GET https://api.target.com/api/v1/admin/users \
-H "Authorization: Bearer <regular_user_token>"
# Test concurrent sessions
# Login from multiple devices simultaneously - should both remain valid?
# Test session invalidation after logout
TOKEN=$(curl -s -X POST https://api.target.com/api/v1/auth/login \
-d '{"email":"test@test.com","password":"pass"}' | jq -r '.token')
# Logout
curl -X POST https://api.target.com/api/v1/auth/logout \
-H "Authorization: Bearer $TOKEN"
# Try using the same token (should fail)
curl -X GET https://api.target.com/api/v1/users/me \
-H "Authorization: Bearer $TOKEN"
# Test session invalidation after password change
# Token obtained before password change should be invalidated
# Test for authorization code interception
# Check if PKCE (Proof Key for Code Exchange) is enforced
# Test with missing code_verifier parameter
# Test redirect URI manipulation
# Try custom scheme hijacking: myapp://callback
# Test with modified redirect_uri parameter
# Test scope escalation
# Request higher privileges than granted
| Term | Definition |
|---|---|
| BOLA/IDOR | Broken Object Level Authorization - accessing resources by changing identifiers without server-side authorization checks |
| JWT | JSON Web Token - self-contained authentication token with header, payload, and signature components |
| PKCE | Proof Key for Code Exchange - OAuth 2.0 extension preventing authorization code interception in mobile apps |
| Token Refresh | Mechanism for obtaining new access tokens using long-lived refresh tokens without re-authentication |
| Session Fixation | Attack where adversary sets a known session ID before victim authenticates, then hijacks the session |