Skill UI

Walks through broken authentication assessments by analyzing login flows, password policies, brute-force/credential-stuffing, and session/token security to document vulnerabilities and mitigation steps for web applications.

Guides analysts through assessing web authentication, credential stuffing, password policies, session tokens, and fixation flows to uncover broken authentication risks before attackers do.

Guides analysts through assessing web authentication, credential stuffing, password policies, session tokens, and fixation flows to uncover broken authentication risks before attackers do.

Details how to implement robust API rate limiting and throttling using advanced techniques like Token Bucket, Sliding Window, and Fixed Window algorithms. Supports per-user, per-IP, and per-endpoint quotas, utilizing Redis for distributed counting. Essential for protecting APIs against brute force, credential stuffing, and resource exhaustion attacks, returning proper HTTP 429 responses.

This solution provides a comprehensive framework for detecting compromised cloud credentials across AWS, Azure, and GCP. It analyzes anomalous API activity, impossible travel patterns, and indicators of credential stuffing by leveraging services like AWS GuardDuty, Azure Defender, and GCP SCC. Use this when investigating suspicious cloud API calls, responding to exposed credential alerts, or scoping a potential account takeover.