What problem does it solve?
Security testers and red teamers frequently miss critical authentication, authorization, and IDOR vulnerabilities in web applications due to inconsistent, ad-hoc testing approaches that fail to cover all access control boundaries and bypass techniques.
Core Features & Use Cases
- Systematic Endpoint Mapping: Build complete inventories of application endpoints from proxy history, JavaScript source, OpenAPI specs, and HTML to ensure no access-controlled routes are overlooked.
- Multi-Role Permission Matrix Testing: Test every endpoint against unauthenticated, low-privilege, peer, and high-privilege user contexts to uncover horizontal and vertical privilege escalation flaws.
- Comprehensive Bypass Technique Coverage: Includes 15+ IDOR manipulation methods, path manipulation tricks, header-based bypasses, JWT attack patterns, and business logic bypass techniques to exhaust all access control failure paths.
- Structured Testing Ledger: Enforces consistent documentation of all test results, bypass attempts, and findings to prevent retesting and support clear, actionable reporting.
Use Case: A penetration tester assessing a customer-facing web application can use this skill to methodically test all API endpoints for hidden IDOR flaws, role-based access control bypasses, and business logic vulnerabilities that would be missed with random, unstructured testing.
Quick Start
Use the auth-matrix-testing skill to systematically test all access control boundaries of your target web application and identify authentication, authorization, and IDOR vulnerabilities.
