hunt-brute-force

@elementalsouls · 收录于 3 周前 · 上游提交昨天

Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).

场景安全测试渗透测试上线前检查

适合你，如果需要对Web应用做登录安全评估

/ 下载安装

https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-brute-force ↗

/ 通过 npx 安装 校验哈希

npx oh-my-skill add elementalsouls/claude-bughunter/hunt-brute-force

/ 通过 bash 安装

curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- elementalsouls/claude-bughunter/hunt-brute-force

/ 已经装过?验证本机副本,不用重装

npx oh-my-skill verify elementalsouls/claude-bughunter/hunt-brute-force

安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。

3216GitHub stars

~4K上下文体积 · 单文件

索引托管

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。

…