What problem does it solve? Static scans can flag suspected authentication and session weaknesses, but they cannot prove whether a JWT signature is actually verified, whether logout really invalidates a token, or whether login cookies lack security flags. This Skill dynamically confirms exploitability against a running staging or local target, eliminating false positives with real HTTP evidence. ## Core Features & Use Cases - JWT Tampering Tests: Fires four mutated token variants (alg=none, signature stripped, role escalation, expired) at a protected endpoint and flags any 2xx response as a signature-verification vulnerability. - Token Reuse & Cookie Checks: Verifies whether a token still works after logout and inspects Set-Cookie headers for missing Secure, HttpOnly, and SameSite attributes. - Fail-Closed Safety Gate: Every request passes through scope_guard, which blocks production or public targets at the code level; all probes are non-destructive GETs. - Use Case: After a static scan flags JWT handling in a Spring Boot app, run this Skill against http://localhost:8080 with a test account to confirm whether a forged admin token is actually accepted, then generate a severity-ranked report. ## Quick Start Ask the AI to run the auth-session penetration test against your local staging URL with a test account to confirm whether JWT tampering and token reuse actually succeed.
