Results for “account-takeover”

Investigate suspected email account takeovers by examining audit logs, sign-ins, inbox rules, and app permissions. Identify suspicious forwarding, unlikely travel between sign-ins, and unusual access, then summarize findings and recommended containment actions in a severity-rated report.

• Investigating suspected business email compromise
• Checking for suspicious external forwarding rules
• Reviewing unusual sign-ins and app permissions

Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs invalid email, (2) reset token exposed directly in the API response body, (3) reset token not invalidated after use (replay), (4) password reset link works from a different IP/browser (no binding), (5) no rate limit on the reset request endpoint. These are the standalone recovery-flow broken-auth primitives — distinct from reset-email host-header poisoning (hunt-host-header) and the full ATO chain (hunt-ato owns password-reset as an ATO path; prove the primitive here, chain it there). Detection: trace the full forgot-password flow from request to token to use; check response diffs between valid/invalid emails; test token replay after consumption. Medium to High (enumeration=Medium, token-reuse=High, account-takeover=Critical when chained to known-email).

The English summary is being prepared. Showing the original description.

Identify and exploit logic flaws in OAuth implementations, focusing specifically on the absence or improper validation of the `state` parameter, which leads to Cross-Site Request Forgery (CSRF) and account takeover (ATO).

The English summary is being prepared. Showing the original description.

Identify and exploit logical flaws in OAuth 2.0 and OpenID Connect workflows. Use this skill when testing "Sign in with Google/Facebook/Apple" features, focusing on Authorization Code interception, Implicit flow token leakage, standard CSRF bypassing via missing `state` parameters, and redirect logic flaws.

The English summary is being prepared. Showing the original description.

Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.

The English summary is being prepared. Showing the original description.

How to identify and test for account takeover vulnerabilities in web applications. Use this skill whenever the user mentions account takeover, authentication bypass, password reset attacks, email verification bypass, session hijacking, or any technique to compromise user accounts. This includes testing authorization issues, unicode normalization attacks, reset token reuse, CORS/CSRF/XSS exploitation, cookie manipulation, and OAuth vulnerabilities.

The English summary is being prepared. Showing the original description.

Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.

The English summary is being prepared. Showing the original description.

Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.

The English summary is being prepared. Showing the original description.