Skip to content
Get packs

Forced Browsing Auth Bypass Testing

Lets an agent hunt for unprotected admin pages, APIs and exposed files during authorized security tests

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, this skill teaches an AI agent a structured workflow for penetration testers checking whether a web application's sensitive pages are really protected. The agent can guide or run URL and file enumeration with tools like ffuf and Gobuster, probe common admin and debug paths, compare responses with and without a login session, try HTTP method and path-normalization tricks, and look for exposed backup or configuration files. It also includes a Python script that automates the unauthenticated versus authenticated comparison for a list of endpoints.

Great for

  • Penetration testers working under a signed written scope agreement
  • Security teams auditing whether every endpoint enforces session checks before release
  • Students learning web application access control in a lab environment

Skip it if

  • Testing websites you do not own or have written permission to assess, since the steps probe for hidden and protected resources and may be illegal or harmful without authorization
  • Developers who only want to fix their own app; the skill is oriented toward attacking and finding bypasses rather than hardening defenses

Try asking

  • “Use the forced browsing skill to enumerate hidden admin and API paths on our staging app, which I have written permission to test”
  • “Check whether /actuator, /swagger-ui and /.env are exposed on this lab target and compare responses with a valid session cookie”
  • “Write an ffuf command set to find backup files like .bak and .old on the authorized test host”
Step-by-step guide: how to use Forced Browsing Auth Bypass TestingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    bypassing-authentication-with-forced-browsing.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip bypassing-authentication-with-forced-browsing.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip bypassing-authentication-with-forced-browsing.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only run against systems with written authorization and a defined scope; keep the test host list explicit.
  • Use the lab or staging environment first and review the script's requests before executing, because it disables TLS verification (verify=False) and sends many requests.
  • Provide a test account cookie in a controlled way and avoid pasting production credentials into chat.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.