Can this skill find hidden API endpoints?

Yes, it includes specialized workflows for enumerating common API paths and testing if those endpoints enforce proper session validation.

Is it safe to use these techniques on any website?

No, these techniques should only be performed during authorized penetration tests with explicit written permission from the target owner to avoid legal issues.

What is forced browsing in web security?

Forced browsing is a technique where an attacker attempts to access URLs that are not linked by the application but exist on the web server, such as administrative panels or configuration files.

Does this skill help with OWASP compliance?

Yes, it directly addresses 'A01:2021 - Broken Access Control,' which is a primary category in the OWASP Top 10 web application security risks.

Which tools are required for this skill?

This skill utilizes industry-standard security tools including ffuf, Gobuster, Burp Suite, and the SecLists wordlist collection for effective directory brute-forcing.

Forced Browsing & Auth Bypass

Name: Forced Browsing & Auth Bypass
Author: micsapp

bymicsapp

0•

Security & Testing

Identifies unprotected web pages and administrative interfaces to test authentication enforcement during authorized security audits.

This skill provides a comprehensive framework for discovering hidden or unprotected assets within web applications using automated tools like ffuf and Gobuster. It guides security professionals through the process of enumerating directories, testing API endpoints, and exploiting misconfigurations in URL normalization or HTTP methods to bypass authentication controls. By following these structured workflows, users can validate that all sensitive resources and administrative functions properly enforce access control mechanisms, identifying critical vulnerabilities before they can be exploited.

Key Features

01Authentication enforcement testing across various HTTP methods

02Automated directory and file enumeration with ffuf and Gobuster

030 GitHub stars

04Path normalization and URL encoding bypass techniques

05Identification of sensitive backup and configuration file exposure

06Detection of hidden administrative panels and debug interfaces

Use Cases

01Validating API endpoint security against unauthenticated direct access

02Security auditing to find exposed sensitive configuration or backup files

03Authorized penetration testing of web application access controls

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills bypassing-authentication-with-forced-browsing

For use in Claude.ai and ChatGPT

Key Features

01Authentication enforcement testing across various HTTP methods

02Automated directory and file enumeration with ffuf and Gobuster

030 GitHub stars

04Path normalization and URL encoding bypass techniques

05Identification of sensitive backup and configuration file exposure

06Detection of hidden administrative panels and debug interfaces

Use Cases

01Validating API endpoint security against unauthenticated direct access

02Security auditing to find exposed sensitive configuration or backup files

03Authorized penetration testing of web application access controls

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills bypassing-authentication-with-forced-browsing

For use in Claude.ai and ChatGPT