hunt-auth-bypass
⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
- Ask the user to state the exact target URL, IP, account, or resource.
- Ask the user to confirm written authorization and the permitted scope.
- Show the exact command(s) and explain their expected effect.
- Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
Scope and evidence boundaries
Test only explicitly scoped portals and owned test accounts; discovering sibling hosts or legacy endpoints does not authorize them. Reachability, method lists, status differences or ten uniform failures do not prove bypass, unlimited guessing, absent MFA or account takeover. No credential stuffing, breached credentials, mass multicall guessing or real-user data extraction. Use minimal canary data and stop at the agreed proof boundary. Historical report counts, payouts and case details below are unverified imported claims; validate the primary disclosure and affected configuration before relying on them.