Screened · automated checks passed

hunt-mfa-bypass

from elementalsouls/Claude-BugHunter · ★ 2,975 on GitHub · found by our crawler 2026-07-07

What the author says it does

Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice), (4) brute-force the 6-digit OTP without rate limit (10^6 attempts at server speed), (5) race condition on OTP validation, (6) recovery-code dump via /api/me, (7) backup factor downgrade (SMS factor with no rate limit). Plus the chain: cookie theft + password oracle + no step-up = ATO without MFA challenge. Detection: trace auth flow in Burp, find every state transition, check if MFA is middleware-gated vs per-endpoint, check OTP entropy and rate limit on OTP-validate. Validate: attacker session reaching post-MFA state. Use when hunting auth bypass, MFA flows, chaining primitives toward ATO.

Quoted from the skill's own SKILL.md trigger description — this is what tells Claude when to activate it. Not yet verified by us.

Automated screening

100/100 validator score

Scored by the same rules as our free SKILL.md validator: trigger description quality, body substance, structure. Automated — a human bench test is the next step in the pipeline.

Install (unverified — review first)

git clone https://github.com/elementalsouls/Claude-BugHunter
# skill lives at: skills/hunt-mfa-bypass/SKILL.md

SkillProof status

This skill is in our test queue. We install every skill in a clean environment, run a trigger battery and score output against a baseline before it earns a catalog page — the full protocol is public. Until then, treat it like any unreviewed dependency: read the SKILL.md and any scripts before installing.

Already tested in Crypto & Web3

  • Vly Money ★ 9.6/10 Builds vly.money deep links for crypto sends and X402 paywalled-content redirects -- no execution, just correct URLs.
  • Quicknode Skill ★ 9.6/10 Quicknode's own reference skill covering RPC, Streams, SQL Explorer, x402/MPP agent payments, CLI, MCP, and more.
  • Wallet Security Review ★ 9.2/10 Structured 8-section wallet security checklist: keys, approvals, signing, phishing, opsec, multisig, incident response.
  • Cosmos Vulnerability Scanner ★ 9.2/10 Spawns parallel Cosmos SDK / CosmWasm scanners for chain-halt and fund-loss bugs across 54 documented patterns.

Top 10 Crypto skills, ranked →