Skip to main content
affpapa.org
RU EN
skill

broken-authentication — Claude Code skill: setup and testing

This skill guides security checks for web login flows, password rules, and session handling. Use it when reviewing authentication controls or multi-factor login.

Install into Claude Code · claude-code-templates All methods and platforms ↓ 
npx claude-code-templates@latest --skill security/broken-authentication
Open on GitHub

What broken-authentication does

The skill lays out a workflow for examining how a web application authenticates users. It covers password requirements, account discovery through server responses, and controls that restrict repeated login attempts. Other checks focus on password guessing and attempts to log in with credentials exposed in earlier breaches.

Session checks examine token randomness, predictable values, cookie security attributes, and whether login replaces the previous session identifier. The workflow also covers expiration, logout invalidation, and weaknesses in multi-factor authentication. Burp Suite, Hydra, and browser developer tools are among the listed utilities. A Python example uses the requests library to collect session cookies for analysis.

Testing requires the target application's URL, test credentials, and written permission from its owner. Familiarity with HTTP, cookies, and authentication methods is also expected. Do not run credential attacks against systems without authorization.

What it helps with

  • Inspect password length and complexity requirements
  • Detect responses that reveal whether an account exists
  • Assess login throttling and defenses against reused leaked credentials
  • Check session token predictability and expiration behavior
  • Find weaknesses in multi-factor authentication flows

Example prompts for the agent

  • Review my web application's password rules and check whether login responses reveal valid accounts.
  • Audit session handling, including cookie flags, expiration, and session ID rotation after login.
  • Prepare an authorized test plan for login rate limits and multi-factor authentication bypass risks.

How to install broken-authentication

1claude-code-templates

npx claude-code-templates@latest --skill security/broken-authentication

2Skills CLI (Vercel)

npx skills add davila7/claude-code-templates --skill broken-authentication -a claude-code

3Manually: put the files in place

~/.claude/skills/broken-authentication/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/broken-authentication/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about broken-authentication

How do I install broken-authentication in Claude Code?

Run npx claude-code-templates@latest --skill security/broken-authentication. As an alternative, use npx skills add davila7/claude-code-templates --skill broken-authentication -a claude-code. The skill file is also listed at ~/.claude/skills/broken-authentication/SKILL.md.

What does the broken-authentication skill do?

It provides a testing workflow for login security and session management in web applications. The checks cover password rules, repeated login attempts, session tokens, and multi-factor authentication.

Which tools are needed for broken-authentication?

The workflow names Burp Suite Professional or Community, Hydra or a comparable password-testing utility, custom credential lists, and browser developer tools. Its session analysis example also uses Python and the requests library.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set804

The whole set →
business-scenario-explorer A slash command that maps out several business timelines — baseline, optimistic, pessimistic and disruption — and turns them into a decision matrix. 273installs transcribe Transcribes audio recordings into text and identifies speakers using OpenAI models. Helpful when processing interviews and team meetings. 272installs playwright-e2e-builder A skill that plans and builds Playwright E2E suites. It interviews you about flows and auth first, then writes the tests. 271installs update-branch-name Renames the active Git branch based on its changes against main. It is useful when you started coding on a temporary branch like temp. 270installs c4-architecture Creates software architecture documentation and C4 model diagrams using Mermaid syntax from your codebase. 269installs dotnet-backend Guides Claude Code through building and changing ASP.NET Core services with EF Core, authentication, and background work. Useful for .NET backend tasks. 267installs sync Matches task statuses against commit history and points out what should move next. Useful when the tracker and git tell different stories. 263installs rollback-deploy Walks an agent through rolling a deployment back to the previous version, with safety checks and database handling. 260installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor