Тестирование аутентификации и управления сессиями

★ 6.6 · security

broken-authentication is a Claude Code skill that identifies authentication and session management vulnerabilities in web applications across eight structured testing phases. It covers authentication mechanism analysis (forms, basic auth, JWT, OAuth, MFA), password policy evaluation, username enumeration, brute-force attacks with Hydra and Burp Suite Intruder, credential stuffing using breached credential pairs, session token entropy analysis via Python scripts, session fixation testing, and session timeout validation. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems. The skill targets penetration testers and security engineers who need a structured methodology with deliverables including an Authentication Assessment Report and remediation recommendations.