<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Authentication Bypass Templates — API Reference

## Nuclei Auth Bypass Scanning Options

```bash
# Scan with auth bypass template
nuclei -u https://target.com -t auth-bypass.yaml -json

# With custom auth header for IDOR testing
nuclei -u https://target.com -t idor.yaml -H "Authorization: Bearer token" -json

# Default credentials with payload mode
nuclei -u https://target.com -t default-creds.yaml -json
```

## Payload Attack Types

| Type | Description |
|------|-------------|
| `sniper` | Single payload position iterated |
| `pitchfork` | Parallel iteration of payload lists |
| `clusterbomb` | Cartesian product of all payload lists |

## Authentication-Related Matchers

| Pattern | Purpose |
|---------|---------|
| `negative: true` | Exclude false-positive keywords |
| `condition: and` | All matchers must match |
| `internal: true` | Matcher for flow control only |
| `part: body_N` | Match Nth response in chain |

## Cross-Request DSL Variables

| Variable | Description |
|----------|-------------|
| `status_code_N` | Status code of Nth response |
| `body_N` | Body content of Nth response |
| `header_N` | Headers of Nth response |
| `all_headers_N` | All headers of Nth response |
| `content_length_N` | Content length of Nth response |

## Common Auth Bypass Techniques

| Technique | Template Pattern |
|-----------|-----------------|
| Default credentials | Clusterbomb with user/pass payloads |
| JWT none algorithm | Forged token with `alg: none` |
| IDOR | Sequential ID enumeration with auth token |
| Path traversal | Encoded traversal sequences to admin paths |
| Method override | X-HTTP-Method-Override header injection |
| Session fixation | Pre-set session ID before authentication |
