Skill UI

Assess JWT implementations for algorithm confusion, none bypass, kid/JKU/X5U injections, and weak secrets to detect authentication bypass and privilege escalation risks during API, OAuth/OIDC, or SSO penetration tests.

Guides security testers through scanning web apps for leaked API keys, exposed config files, over-verbose responses, and insecure transport to ensure compliance during penetration tests.

Guides penetration testers through identifying XML entry points, crafting XXE payloads, and exploiting blind or file-reading vulnerabilities to retrieve secrets or trigger callbacks during authorized assessments.

A practitioner workflow for assessing JSON Web Token implementations during penetration tests, covering token analysis, algorithm confusion, brute-forcing secrets, and claim manipulation to reveal authentication or authorization weaknesses in APIs and microservices.

Assess mobile backend APIs for authentication and authorization weaknesses, covering JWT/OAuth flaws, insecure token handling, session fixation, IDOR, and privilege escalation during penetration tests of mobile apps.