skills.rest
bs-koo
bs-kooCOMMUNITY
Explore all skills by this author →
GitHub

detecting-auth-session-weaknesses

Detect authentication, session, and JWT vulnerabilities in Spring Boot and JSP web applications.

Updated Jun 24, 2026
Search Tags:#authentication#jwt#owasp#semgrep#spring-security#vulnerability-scanning#session-security
One-click install
npx skills add https://github.com/bs-koo/gx-security --skill detecting-auth-session-weaknesses-bs-koo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-auth-session-weaknesses
Source: https://github.com/bs-koo/gx-security/tree/main/skills/detecting-auth-session-weaknesses
Command: npx skills add https://github.com/bs-koo/gx-security --skill detecting-auth-session-weaknesses-bs-koo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Web applications built on Spring Boot or legacy JSP/Servlet stacks often contain authentication and session weaknesses—hardcoded JWT secrets, plaintext password storage, session fixation, and missing cookie security flags—that static scanners alone either miss or over-report. This Skill combines Semgrep rule scanning with AI context verification to confirm real vulnerabilities and filter out false positives. ## Core Features & Use Cases - Stack-aware scanning: Automatically detects spring-modern vs jsp-legacy codebases and applies the matching Semgrep ruleset, with a grep fallback when Semgrep is unavailable. - AI context verification: Each scanner candidate is verified against actual code—JWT signature validation, session regeneration on login, BCrypt usage, and cookie Secure/HttpOnly/SameSite attributes. - Structured severity report: Confirmed findings are reported with what is vulnerable, why, how it can be exploited, and how to fix it, mapped to CWE and OWASP A07:2021. - Use Case: Point it at a legacy eGovFrame project to confirm that hash="plaintext" in context-security.xml means passwords are stored as reversible Base64, and receive a BCrypt migration fix. ## Quick Start Ask the AI to check the target project source for authentication, session, and JWT vulnerabilities using this skill.

Frequently Asked Questions about detecting-auth-session-weaknesses

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect session fixation vulnerabilities in Java web applications?▼

Check whether the login handler calls session.invalidate() or changeSessionId() before setting the authenticated attribute. This skill's scanner flags getSession().setAttribute("LoginVo", ...) patterns lacking session regeneration, then AI verification confirms exploitability.

How to check if JWT secrets are hardcoded in Spring Boot code?▼

Scan for String fields named secretKey, jwtSecret, or signingKey assigned string literals without @Value injection. The skill's Semgrep rule sqisoft-spring-jwt-secret-hardcoded detects this, and verification checks for environment variable injection and minimum key length validation.

Does this scanner work without Semgrep installed?▼

Yes, scan_auth.py falls back to regex-based grep scanning when Semgrep is unavailable. The fallback has lower precision, so the script prints a warning and the AI context verification step becomes more important for filtering false positives.

What is the difference between SHA-256 and BCrypt for password storage?▼

SHA-256 is a fast hash vulnerable to GPU brute-force attacks even with a salt, while BCrypt is intentionally slow with built-in salt and adjustable work factor. The skill flags SHA-256 and plaintext password configurations and recommends BCryptPasswordEncoder migration.

Why does the scanner report zero findings on my project?▼

Zero findings may mean the project structure was not recognized as spring-modern or jsp-legacy, or the grep fallback missed candidates. The script emits warnings in these cases since zero candidates does not guarantee the code is safe.

Related Skills

Explore More Software Engineering Skills→
santosomarsantosomar
1

spring-mvc-to-boot-migrator

Convert Spring MVC XML configurations to Spring Boot Java-based configurations.

Community
Advanced
IMIOIMIO
5

security-pentest

Scan SmartWeb staging repositories and HTTP endpoints for security vulnerabilities.

Official
Advanced
petrogurcakpetrogurcak

security-review

Audit application code for OWASP Top 10 vulnerabilities.

Community
Advanced
simotasimota
68

Probe

Perform dynamic security testing with OWASP ZAP and Burp Suite.

Community
Advanced