What problem does it solve? Bug bounty hunters and penetration testers need a systematic taxonomy for finding account takeover (ATO) vulnerabilities, which are among the highest-severity findings but easy to miss without structured coverage of reset flows, email change, OAuth, MFA, and session handling. ## Core Features & Use Cases - Nine ATO Attack Paths: Covers password reset poisoning via host header injection, token leakage through referer headers, predictable reset tokens, non-expiring tokens, email change without re-authentication, OAuth account-link CSRF, MFA bypass, session fixation, and SSO subdomain takeover. - Chain Primitives: Documents how to combine findings such as cookie theft plus password oracle plus missing step-up authentication into Critical-severity persistent ATO, and OAuth open redirect with subdomain takeover into auth code theft. - Severity Prioritization: Provides a priority model ranking no-interaction ATO as Critical down to MitM-dependent paths as Low, with validation requiring actual takeover demonstration on a test account. - Use Case: While testing a target's password reset flow, send a forgot-password request with a modified Host header to check whether the reset link is constructed from the attacker-controlled domain, then chain with subdomain enumeration for an OAuth redirect_uri takeover. ## Quick Start Ask the agent to test the target application's password reset and email change endpoints for account takeover paths using the hunt-ato taxonomy.
