Tagged auth

Coerce machine authentication with PetitPotam and Coercer to relay NTLM into AD CS

Test REST, GraphQL and gRPC APIs for auth, rate limit and business logic flaws

Test iOS and Android apps for storage, network and auth flaws using the OWASP MASTG

Roll out Cisco Duo MFA on VPN, RDP and SSH with adaptive policies and WebAuthn

Configure OAuth 2.0 flows with PKCE, client credentials and device grant per OAuth 2.1

Deploy a software-defined perimeter with single packet auth and mutual TLS

Detect impossible travel, password spraying and credential stuffing with UEBA baselines

Spot lateral movement in auth logs, SMB and RDP sessions with Zeek and Velociraptor

Detect stolen OAuth tokens and replayed refresh tokens in Entra ID sign-in logs

Catch Kerberos pass-the-ticket abuse using Splunk and Elastic queries on auth events

Flag risky OAuth app consent grants in Entra ID using Graph audit logs

Test JWT algorithm confusion, alg none and kid injection to bypass auth checks

Test MongoDB and CouchDB apps for NoSQL injection that bypasses login or leaks data

Find OAuth and OIDC flaws in redirect URIs, token leakage and code theft

Bypass PHP login checks with loose comparison and magic hash type juggling

Test WebSockets for auth bypass, cross-site hijacking and injection flaws

Harden the Docker daemon with daemon.json, TLS auth, user namespaces and seccomp

Hunt credential stuffing via login velocity, ASN spread and failed-login geography

Hunt stolen SSO sessions and token replay in Entra ID and Okta logs

Enforce auth, throttling, request validation and TLS at Kong, AWS or Apigee gateways

Harden Google Workspace with phishing-resistant MFA, OAuth controls and sharing limits

Set up SAML SSO for Google Workspace with Okta, Entra ID or ADFS as the IdP

Build a FIDO2 and WebAuthn server with YubiKey enrollment and passkey workflows

Sign and verify JWTs with ES256 or EdDSA and block algorithm confusion attacks

Roll out passwordless sign-in in Entra ID with FIDO2 keys and passkeys

Add FIDO2 and WebAuthn passkeys with platform authenticators and NIST AAL3 controls

Set up SAML SSO with Okta for attribute mapping, certificate rotation and logout

Build Schnorr zero-knowledge proofs so logins never send the password to the server

Secure Microsoft 365, Slack and Salesforce with CASB, SSPM and OAuth app controls

Run Okta for cloud SSO, FastPass MFA, user provisioning and adaptive access policies

Trace AD compromise via auth logs, replication metadata and Kerberos anomalies

Forge JWTs with alg none using PyJWT and a proxy to test signature checks

Reconstruct Linux sessions from auth.log, journalctl and auditd for forensic timelines

Find over-permissioned OAuth app grants and excessive API scopes in SaaS platforms

Relay coerced NTLM auth to AD CS web enrollment (ESC8) in internal pentests

Test API auth for broken token checks, JWT flaws and credential stuffing exposure

Test JWTs for alg none, key confusion and kid injection with jwt_tool

Assess JWT implementations for weak signing, algorithm confusion and auth bypass

Test mobile app backend auth for token handling, session fixation and IDOR

Test OAuth 2.0 and OIDC flows for redirect URI, PKCE and token leakage flaws

Build Zoom meeting joins with the Meeting SDK, auth flows and waiting room fixes

Build Zoom Phone integrations with OAuth, call APIs, webhooks and CTI dialers

Build Zoom REST API apps with endpoint choice, OAuth and rate limit handling

Debug broken Zoom auth, API, webhook or SDK integrations with ranked hypotheses

Isolate the failing layer in broken Zoom auth, webhooks, SDK or MCP setups

Build Zoom Rivet server integrations with webhooks, auth and Lambda receivers

Set up Zoom app credentials, OAuth grants, scopes and token refresh correctly

Get shared Zoom platform guidance on app models, auth scopes and marketplace rules

Embed Zoom meetings in Android apps with the Meeting SDK and PKCE auth