skills.rest
dungsnowaxe
dungsnowaxeCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

authorization-testing

Validate authorization failures by attempting unauthorized access with lower-privileged credentials.

1|Updated Mar 4, 2026
Search Tags:#authorization#security testing#access control#privilege escalation#dast#idor
One-click install
npx skills add https://github.com/dungsnowaxe/prometheus-red-team-bot --skill authorization-testing-dungsnowaxe
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: authorization-testing
Source: https://github.com/dungsnowaxe/prometheus-red-team-bot/tree/main/promptheus/skills/dast/authorization-testing
Command: npx skills add https://github.com/dungsnowaxe/prometheus-red-team-bot --skill authorization-testing-dungsnowaxe

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and validates authorization failures in web applications, ensuring that users can only access resources and perform actions they are explicitly permitted to.

Core Features & Use Cases

  • IDOR Detection: Finds Insecure Direct Object References (CWE-639) where users can access other users' data.
  • Privilege Escalation Testing: Tests for vertical (CWE-269) and horizontal (CWE-639) privilege escalation.
  • Missing Access Control Validation: Verifies that authorization checks are present for sensitive functions (CWE-862, CWE-863, CWE-425).
  • Use Case: An attacker attempts to access an administrator's profile by manipulating user IDs in API requests. This Skill automates that attempt and reports if the access is unexpectedly granted.

Quick Start

Test for authorization bypasses by attempting to access unauthorized resources with lower-privileged credentials.

Frequently Asked Questions about authorization-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for IDOR and authorization bypass vulnerabilities in web applications?▼

IDOR and authorization bypass testing validates access controls by attempting unauthorized access with lower-privileged credentials to detect CWE-639 and missing function level restrictions.

What is privilege escalation testing and how does it find access control failures?▼

Privilege escalation testing checks for vertical and horizontal unauthorized access attempts (CWE-269, CWE-639) by manipulating user roles and IDs to verify if improper access is granted.

How do I verify missing access controls for sensitive API endpoints?▼

Missing access control validation verifies authorization checks by sending requests with lower-privileged credentials to sensitive endpoints, detecting CWE-862, CWE-863, and CWE-425 vulnerabilities.

Can I automate DAST checks for CWE-639 and CWE-862 vulnerabilities?▼

Yes, dynamic application security testing automates checks for CWE-639 and CWE-862 by using lower-privileged credentials to attempt unauthorized access and capturing structured evidence of failures.

Do I need authentication patterns to test for insecure direct object references?▼

Yes, authentication patterns are required to test for insecure direct object references, as the validation process relies on lower-privileged credentials to attempt unauthorized resource access.

Related Skills

Explore More Software Engineering Skills→
hoanghn61hoanghn61

cloud-containers

Assess cloud and container environments for security misconfigurations and exploitation paths.

Community
Advanced
yhy0yhy0
74

go-vuln-auth-bypass

Audit Go code for authentication and authorization bypass vulnerabilities.

Community
Advanced
NickCrewNickCrew
29

security-testing-patterns

Identify and mitigate security vulnerabilities in CI/CD pipelines.

Community
Advanced
zaiyemeiyou404zaiyemeiyou404

ctf-web-encoding-bypass

Bypass web application defenses and extract data from CTF challenges.

Community
Advanced