authenticated-session-acquisition

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Authenticated Session Acquisition

已认证会话获取

On financial and multi-tenant targets the login is gated by SMS OTP / TOTP MFA that an autonomous run cannot satisfy, so the post-auth surface (BOLA/IDOR/mass-assignment/injection on the real data APIs, session handling, API pivots) silently collapses to pre-auth findings only. This skill's job is narrow and concrete: get one legitimate authenticated session and hand it to the executors as a reusable artifact. It does not attack the auth mechanism — see

authentication

for that.

在金融类和多租户目标上，登录通常受 SMS OTP/TOTP MFA 限制，而自主运行无法完成此类验证，导致认证后攻击面（针对真实数据 API 的 BOLA/IDOR/mass-assignment/injection、会话处理、API pivots）悄然退化为仅有认证前发现。本 skill 的职责明确且范围有限：**获取一个合法的已认证会话，并将其作为可复用工件移交给执行器。**它不会攻击认证机制——相关内容请参阅

authentication

。

The artifact contract (how the session reaches executors)

会话工件契约（会话如何交付给执行器）

Emit both, into the engagement's OUTPUT_DIR, referenced BY NAME (never inline secrets —

credential-loading.md

```
OUTPUT_DIR/<asset>/session/storageState.json
```
— the Playwright storage state (cookies + localStorage) for browser-driven post-auth testing.
```
OUTPUT_DIR/<asset>/session/bearer.txt
```
— the raw access/ID token (+ its
```
expires_at
```
) for direct API replay.

Executors consume these exactly like any env-loaded secret: the scope file's

creds_env

names the realm, and the session path is passed as a file reference, so no token is ever written into a prompt,

experiments.md

, or

attack-chain.md

. Re-run this skill when the token expires (record

expires_at

; refresh rather than re-login where a refresh token exists).

将以下两项输出到测试项目的

OUTPUT_DIR

，并按名称引用（绝不内联密钥——参见

credential-loading.md

）：

```
OUTPUT_DIR/<asset>/session/storageState.json
```
——Playwright storage state（cookies + localStorage），用于浏览器驱动的认证后测试。
```
OUTPUT_DIR/<asset>/session/bearer.txt
```
——用于直接重放 API 请求的原始 access/ID token（及其
```
expires_at
```
）。

执行器应像加载任何通过环境变量加载的密钥一样使用这些工件：scope 文件中的

creds_env

标识对应 realm，会话路径以文件引用的形式传递，因此绝不能将 token 写入 prompt、

experiments.md

或

attack-chain.md

。token 过期后应重新运行此 skill（记录

expires_at

；如果存在 refresh token，应优先刷新而非重新登录）。

Modes (pick by what the client can provide)

模式（根据客户能够提供的内容选择）

Mode	When	How
TOTP-from-seed	The client shared the TOTP secret (Base32 seed) for a test account	Generate the current code deterministically with `tools/totp_now.py` `<BASE32_SEED>` , submit it in the login flow. Fully autonomous, repeatable.
Explicit-OTP	The operator can read a one-time code (SMS/email/authenticator) at run time	Drive login to the OTP prompt, the operator supplies the code once, continue.
Human-in-the-loop resume	OTP arrives out-of-band and the run must pause	Persist the pre-OTP browser context, pause; the operator completes the challenge; resume and capture `storageState` .

模式	适用场景	方法
TOTP-from-seed	客户提供了测试账户的 TOTP secret（Base32 seed）	使用 `tools/totp_now.py` `<BASE32_SEED>` 确定性地生成当前验证码，并在登录流程中提交。完全自主且可重复。
Explicit-OTP	操作人员能够在运行时读取一次性验证码（SMS/email/authenticator）	将登录流程推进至 OTP 提示界面，由操作人员一次性提供验证码，然后继续执行。
Human-in-the-loop resume	OTP 通过带外渠道送达，运行过程必须暂停	持久化 OTP 前的浏览器上下文并暂停；操作人员完成验证挑战后恢复运行并捕获 `storageState` 。

Provider recipes

IdP 配置指南

Detailed per-IdP flows are in

reference/session-acquisition.md

: Auth0, Okta, Amazon Cognito (SRP auth + the UNSIGNED unauthenticated-posture check), and Descope. Each recipe ends by exporting

storageState.json

bearer.txt

in the contract above.

各 IdP 的详细流程见

reference/session-acquisition.md

：Auth0、Okta、Amazon Cognito（SRP auth + UNSIGNED 未认证状态检查）和 Descope。每份指南最后都会按照上述契约导出

storageState.json

bearer.txt

。

When a session cannot be acquired — defer honestly, do not fake

无法获取会话时——如实延期，不要伪造

If no test account / OTP seed is available and no OTP can be relayed, the realm's post-auth surface is untestable through no fault of the tester. Record it honestly instead of a fabricated

NA

or a silent miss:

File a client-input request at
```
reports/client-input-requests/CIR-NNN.md
```
naming exactly what's needed ("needs test account / OTP seed / allowlist for
```
<realm>
```
").
Set a realm-level
```
BLOCKED_REASON
```
in
```
attack-chain.md
```
.
Mark that realm's post-auth coverage cells
```
status:"deferred"
```
in
```
coverage.json
```
, each carrying
```
deferral_reason
```
+
```
client_input_request
```
(the CIR path) — see
```
coverage-matrix.md
```
. The deterministic gate then discloses the deferred surface in the report rather than hiding it, and only the parent orchestrator (via
```
coverage_gate.py --accept-deferrals
```
) may finalize a substantiated-deferred engagement. A scope that is entirely auth-gated never completes.

The preflight cred-reach probe (

preflight-checklist.md

, Phase-1 gate) is what triggers this path: present creds are not working creds; verify reachability per realm before spawning post-auth executors.

如果没有测试账户/OTP seed，也无法转交 OTP，则该 realm 的认证后攻击面将无法测试，这并非测试人员的过错。应如实记录，而不是伪造

NA

或无提示地遗漏：

在
```
reports/client-input-requests/CIR-NNN.md
```
提交客户输入请求，准确说明所需内容（“需要
```
<realm>
```
的测试账户/OTP seed/allowlist”）。
在
```
attack-chain.md
```
中设置 realm 级别的
```
BLOCKED_REASON
```
。
在
```
coverage.json
```
中将该 realm 的认证后覆盖项标记为
```
status:"deferred"
```
，并分别填写
```
deferral_reason
```
和
```
client_input_request
```
（CIR 路径）——参见
```
coverage-matrix.md
```
。随后，确定性 gate 会在报告中披露延期覆盖范围，而不是将其隐藏。只有父级 orchestrator 可以通过
```
coverage_gate.py --accept-deferrals
```
完成有证据支持的延期测试项目。完全受认证限制的 scope 永远不能标记为完成。

预检凭据可达性探针（

preflight-checklist.md

中的 Phase-1 gate）会触发此路径：已提供的凭据不一定是可用凭据；在启动认证后执行器之前，应按 realm 验证其可达性。

Workflow

工作流

Read the scope: which realms/tenants are in
```
creds_env
```
, which assets are behind them,
```
roe.reversible_writes
```
for the test tenant.
Identify the IdP (login redirect host /
```
/.well-known/openid-configuration
```
/ SDK bundle) → pick the recipe.
Acquire the session in the appropriate mode → write
```
storageState.json
```
+
```
bearer.txt
```
.
Verify: one minimal authenticated request returns an authorized response (not 401/403/login-redirect).
Hand the artifact paths to the post-auth executor batch; on failure, run the defer path above.

阅读 scope：确定
```
creds_env
```
中包含哪些 realm/tenant、哪些资产位于其后方，以及测试租户的
```
roe.reversible_writes
```
。
识别 IdP（登录重定向 host/
```
/.well-known/openid-configuration
```
/SDK bundle）→ 选择相应指南。
采用适当模式获取会话 → 写入
```
storageState.json
```
+
```
bearer.txt
```
。
验证：发送一个最小的已认证请求，并确认返回授权响应，而不是 401/403/login-redirect。
将工件路径移交给认证后执行器批次；失败时，执行上述延期路径。

Anti-Patterns

反模式

Do not paste tokens, seeds, or cookies into prompts,
```
experiments.md
```
,
```
attack-chain.md
```
, or any
```
tools/*.md
```
— reference the artifact file by path only.
Do not brute-force or bypass the OTP/MFA challenge here — that is an
```
authentication
```
finding, not session acquisition.
Do not mark an MFA-blocked cell
```
covered
```
/
```
NA
```
— mark it
```
deferred
```
with a filed CIR so the gate discloses it.
Do not test outside the authenticated tenant you were given, and honor
```
roe.reversible_writes
```
(create-then-delete only in your own test tenant).

不要将 token、seed 或 cookie 粘贴到 prompt、
```
experiments.md
```
、
```
attack-chain.md
```
或任何
```
tools/*.md
```
中——只能通过路径引用工件文件。
不要在此处暴力破解或绕过 OTP/MFA 验证挑战——这是
```
authentication
```
类发现，不属于会话获取。
不要将受 MFA 限制的覆盖项标记为
```
covered
```
/
```
NA
```
——应标记为
```
deferred
```
，并提交 CIR，让 gate 对其进行披露。
不要测试所提供的已认证租户之外的目标，并遵守
```
roe.reversible_writes
```
（仅可在自己的测试租户内执行创建后删除操作）。

Reference

参考

```
reference/session-acquisition.md
```
— per-IdP acquisition recipes (Auth0 / Okta / Cognito / Descope) + the storageState/Bearer export.
```
tools/totp_now.py
```
— stdlib RFC-6238 TOTP generator (the TOTP-from-seed mode).

```
reference/session-acquisition.md
```
——各 IdP 的会话获取指南（Auth0/Okta/Cognito/Descope）+ storageState/Bearer 导出方式。
```
tools/totp_now.py
```
——基于标准库的 RFC-6238 TOTP 生成器（TOTP-from-seed 模式）。