What problem does it solve? Bug bounty hunters and penetration testers often miss account takeover (ATO) vulnerabilities because they test isolated endpoints instead of systematically covering the full taxonomy of ATO paths and chaining primitives together. ## Core Features & Use Cases - Nine-Path ATO Taxonomy: Covers password reset poisoning (host header injection, token leakage via Referer, predictable tokens, non-expiring tokens), email change without re-auth, OAuth account-link CSRF, MFA bypass, session fixation, JWT manipulation, and SSO subdomain takeover. - Chain Primitives: Combines findings like cookie theft, password oracles, OAuth open redirects, and dangling CNAME subdomain takeovers into Critical-severity ATO chains. - Severity Prioritization: Classifies ATO findings from Critical (no user interaction) down to Low (requires MitM) with validation guidance. - Use Case: While testing a target's password reset flow, inject an attacker-controlled Host header into the forgot-password request, observe the reset link pointing to your domain, and demonstrate full account takeover on a test account. ## Quick Start Ask the AI to test the target application's password reset and email change flows for account takeover vulnerabilities using the nine-path ATO taxonomy.
