web-vulnhuntlisted

Authorized security testing methodology for web apps, APIs, multi-tenant SaaS, Spring Boot / Cloud Gateway stacks, FIDO/WebAuthn passwordless auth, mobile backends, and OAuth/SSO integrations. Use whenever the user asks to test, probe, scan, find vulnerabilities in, or pentest any web service — including bug bounty engagements, authorized pentests, CTF challenges, post-patch re-verification, CVSS scoring, subdomain/asset discovery, WAF/auth-filter bypass, **authorization bypass / IDOR / broken access control / missing @PreAuthorize / privilege escalation** testing, FIDO2/UAF testing, token-chain analysis, or writing vulnerability reports. Also triggers on the words "AcmeAuth", "Keycloak", "Okta", "PingFederate", "Auth0", or any passwordless-auth vendor. This is a defensive skill for authorized work only — always confirm scope before any active test.
do-whilefor/JaseSkills · ★ 7 · Web & Frontend · score 74

Install: claude install-skill do-whilefor/JaseSkills

# Web Vulnerability-Hunting Methodology A field-tested methodology for authorized vuln research on enterprise SaaS / API / passwordless-auth targets. Distilled from a 13-session, 30+ finding engagement against AcmeAuth Control Center (Spring Boot 3 + Spring Cloud Gateway + Keycloak + Okta + FIDO1/FIDO2 + Android SDK). **Authorized use only.** Confirm scope (program policy, RoE, written permission) before any active test. Refuse out-of-scope work and document the refusal with rationale. See `references/ethics-and-roe.md`. --- ## When to use this skill Trigger when the user asks to: - Test / probe / pentest / scan / hunt vulnerabilities in a web service, API, or mobile backend - Re-verify a finding after a vendor patch - Bypass a WAF, auth filter, path filter, or 403/401 wall - Enumerate subdomains, assets, customer tenants, or API endpoints - Test FIDO1 UAF, FIDO2/WebAuthn, OAuth, SAML, OIDC, Keycloak, Okta, or other passwordless/SSO flows - Score CVSS for a finding (especially: "is this really High?") - Write a vulnerability report for HackerOne / Bugcrowd / internal - Analyze a JWT, session token, magic-link, or install-token chain - Reverse-engineer a mobile APK for endpoints / SSL-pinning / SSRF surface --- ## Core principles (load-bearing rules) These are the rules that, when skipped, produced false positives or overstated claims in the source engagement. Re-read before any submission. ### 1. Hypothesis first, falsify, record — every time For every test: state th