Skip to content
Get packs

Guide · Agent skill

How to use the Forced Browsing Auth Bypass Testing agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains what the bypassing-authentication-with-forced-browsing agent skill does, how to install it for Claude, and how to ask it for help with authorized web application access control testing. It is written for penetration testers and security teams working under written permission, and for students using a lab. By the end you will know how to install the skill, phrase useful requests, and understand the safety limits before you run anything against a live system.

Forced Browsing Auth Bypass Testingmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Confirm authorization. Make sure you have written penetration testing permission that covers the exact target and directory enumeration.
  2. 2Install the prerequisites. Install Python 3 with requests, ffuf, Gobuster and SecLists, and optionally Burp Suite, as listed on the skill page.
  3. 3Install the skill. Unzip the downloaded ZIP into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings, Capabilities, Skills.
  4. 4Ask with a clear scope. Describe the authorized target and the specific question, such as whether an admin path enforces login.
  5. 5Run enumeration. Use ffuf or Gobuster with a wordlist and conservative rate settings to find unlinked paths.
  6. 6Compare authenticated and unauthenticated responses. Run the comparison with scripts/agent.py or curl using a test session cookie and note endpoints that respond similarly.
  7. 7Record and report findings. Save output with the --output option or -o flags and report only what your authorization allows.

What does the forced browsing skill make the agent do?

The skill gives an AI agent a structured workflow for checking whether a web application's sensitive pages are really protected. Forced browsing means directly requesting URLs that are not linked in the navigation but may still exist on the server. The skill covers URL and file enumeration with tools such as ffuf and Gobuster, probing of common admin and debug paths, and comparison of responses with and without a login session.

It also covers HTTP method tricks, path-normalization variations, and searches for exposed backup or configuration files. A Python script, scripts/agent.py, automates the unauthenticated versus authenticated comparison for a list of endpoints.

  • URL and file enumeration with ffuf and Gobuster
  • Probing admin, debug and API paths such as /admin, /actuator and /graphql
  • Comparing unauthenticated and authenticated responses
  • Testing HTTP methods and path-normalization variants
  • Looking for exposed backup, git and configuration files

How do you install the skill?

Download the ZIP from the skill's page on this site and unzip it. Place the resulting skill folder in ~/.claude/skills/ to make it available to Claude across your projects, or in a project's .claude/skills/ folder to limit it to that project.

You can also upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.

  • Personal install: unzip into ~/.claude/skills/
  • Project install: unzip into the project's .claude/skills/ folder
  • Claude apps: Settings → Capabilities → Skills, then upload the ZIP

What do you need before you use it?

The skill assumes you already have written penetration testing authorization that covers directory enumeration. Without it, do not use the skill against a target. The skill lists the following requirements.

Some requirements are only needed for specific steps, such as the Python library for the script or valid session credentials for authenticated comparisons.

  • Python 3 with the requests library (for scripts/agent.py)
  • ffuf, installed with Go
  • Gobuster, installed with apt
  • Burp Suite (optional), for intercepting and analysing requests
  • SecLists wordlists, obtained with git clone
  • Written penetration testing authorization
  • Valid test session credentials for authenticated comparisons
  • Network access to the target
pip install requests

How do you trigger the skill with natural requests?

You do not need special syntax. State the authorized goal in plain language and name the target you are allowed to test. Be specific about the question you want answered, such as whether an admin area enforces sessions or whether backup files are exposed.

The agent can guide you through the commands or run them, depending on your setup. Mention your scope so the agent keeps its work inside it.

  • Check whether the endpoints listed in my scope file require login.
  • Enumerate hidden directories on the staging host in my signed scope using a medium wordlist.
  • Look for exposed backup or git files on the target in my authorized assessment.
  • Compare responses for these five admin URLs with and without my test session cookie.

How do you run the authentication comparison script?

The script scripts/agent.py takes a target base URL and can probe built-in admin paths, use a custom wordlist, or use a session cookie for authenticated comparison. The reference file lists its arguments and writes results to a file.

Replace the placeholder values with your own authorized target and token.

  • --target: target base URL (required)
  • --wordlist: path to a directory or file wordlist (optional)
  • --session-cookie: valid session cookie for authenticated comparison (optional)
  • --admin-paths: use the built-in common admin path list (optional)
  • --output: write results to a file (optional)
python agent.py --target https://target.example.com --admin-paths --session-cookie <token>

What does a typical ffuf run look like?

The skill's SKILL.md includes ffuf commands for directory and file enumeration. Results can be saved as JSON, and the status-code filters limit output to responses that may matter. Keep the request rate low enough for your scope and the target's capacity.

  • Filter for 200, 301, 302 and 403 responses and exclude 404
  • Save results with -o and -of json
  • Limit threads with -t and request rate with -rate
ffuf -u https://target.example.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403 -fc 404 -o results-dirs.json -of json -t 50 -rate 100

What safety points should you keep in mind?

The skill runs scripts and uses the network, so treat it as a tool that sends real requests to whatever target you give it. Confirm the target is in your written scope before every run, including subdomains and staging hosts. The skill is oriented toward finding bypasses rather than hardening defenses, and its steps probe for hidden and protected resources, which may be illegal or harmful without authorization.

Review commands before running them, especially scripts, and check the rate and thread settings so you do not disrupt a live service.

  • Only test systems you own or have written permission to assess
  • Verify scope before every run, including the exact hostnames
  • Review scripts/agent.py and any generated commands before running them
  • Use a test account and session cookie, not production user credentials
  • Lower -t and -rate on fragile systems

What people use it for

  • A penetration tester checks whether admin URLs found during enumeration return content without a session.
  • A security team audits whether every API endpoint enforces session checks before a release.
  • A student practises access control testing against a deliberately vulnerable lab application.
  • An engineer checks whether backup, git or configuration files are exposed on a staging server they own.

Frequently asked questions

How do I install the bypassing-authentication-with-forced-browsing skill?

Download the ZIP from the skill's page on this site and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.

What do I need to use the forced browsing auth bypass skill?

You need written penetration testing authorization, Python 3 with the requests library for the script, ffuf, Gobuster, and SecLists wordlists. Burp Suite is optional, and valid test session credentials are needed only for authenticated comparisons.

Is the bypassing-authentication-with-forced-browsing skill free?

The skill is listed under the Apache-2.0 licence, as stated on its page. Check the licence file in the downloaded package for the full terms.

Can I use this skill on any website?

No. The steps probe for hidden and protected resources and may be illegal or harmful without authorization. Only use it on systems you own or have written permission to assess.

What tools does this skill use?

It uses ffuf for fuzzing, Gobuster for directory brute-forcing, curl for manual checks, and a Python script for the authenticated comparison. Burp Suite is suggested for intercepting requests and responses.

Why does the skill need a session cookie?

A valid session cookie lets the comparison check whether an endpoint returns different content for a logged-in user than for an anonymous request. Without one, the script can only test unauthenticated access.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits penetration testers with written scope, security teams auditing session enforcement, and students working in a lab. It is not suited to testing systems you do not own or lack permission for, and developers who only want to harden their own application will get more value from defensive guidance.

Download the skill