DevOps & Infrastructure
Hunt ATO
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host header injection redirects token to attacker, predictable token, token leaked in referer, race condition on reset link), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session-fixation, (6) JWT manipulation, (7) password change without step-up (chain with password oracle), (8) social-recovery question abuse, (9) SSO subdomain takeover. Chain primitives: cookie theft + password oracle + missing step-up = persistent ATO; OAuth open redirect + redirect_uri = auth code theft = ATO; subdomain takeover at OAuth redirect_uri = ATO. Validate: actual account takeover demonstration on test account B from attacker A's session. Real paid examples for each path. Use when hunting ATO chains, when testing password reset / email change / MFA / OAuth / session, when chaining primitives toward Critical.
- Publisher / source
- adriannoes/awesome-agentic-ai (found on the CSV list)
- Upstream record
- adriannoes/awesome-agentic-ai
- Version
- Version 2
- Published
- Publication review
- Approved for publication
- Content fingerprint
729acb269d65b398efaa60faf6fa4bcaee0045799f935e0350785655943da0ac