broken-access-controll-detect

Detect broken access control vulnerabilities using controlled-account comparison.

Updated May 16, 2026

Search Tags:#security #access control #penetration testing #vulnerability detection #web application

Ready to run

npx skills add https://github.com/Chid0k/claude-marketplace --skill broken-access-controll-detect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: broken-access-controll-detect
Source: https://github.com/Chid0k/claude-marketplace/tree/main/plugins/vuln-detect-plugin/skills/broken-access-controll-detect
Command: npx skills add https://github.com/Chid0k/claude-marketplace --skill broken-access-controll-detect

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This skill helps identify broken access control vulnerabilities in web applications, ensuring that proper authorization is enforced across different user roles, contexts, and operations.

Core Features & Use Cases

Broken Access Control Detection: Identifies various flaws such as bypassing authorization, horizontal/vertical privilege escalation, IDOR/BOLA, BFLA, and mass assignment vulnerabilities.
Controlled Testing: Uses controlled accounts and reversible data for testing, emphasizing safety and non-destructive validation.
Reproducible Workflow: Provides a structured methodology for reproducing and confirming findings, minimizing false positives.
Use Case: Imagine you have a web application with multiple user roles. This Skill helps ensure that sensitive actions like data modification or deletion can only be performed by authorized users, reducing the risk of data breaches.

Quick Start

To detect broken access control in your application, use the skill by executing the test sequence with controlled test accounts and data.

Frequently Asked Questions about broken-access-controll-detect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect broken access control vulnerabilities in a web application?▼

Broken access control vulnerabilities are detected by validating that sensitive operations are restricted to authorized users based on their roles and permissions using controlled-account comparison and non-destructive evidence collection.

What is the best way to test for IDOR and BOLA vulnerabilities?▼

Testing for IDOR and BOLA vulnerabilities involves comparing access across controlled test accounts to verify that sensitive data modification or deletion is restricted to authorized roles, minimizing false positives through reproducible workflows.

Can I check for vertical and horizontal privilege escalation without destroying data?▼

Yes, you can check for privilege escalation safely by using controlled test accounts and reversible data for testing, emphasizing safety and non-destructive validation to identify unauthorized access flaws.

Does mass assignment detection require specific user roles for testing?▼

Mass assignment detection requires multiple user roles to ensure that sensitive actions like data modification or deletion can only be performed by authorized users, reducing the risk of data breaches.

Why does broken access control testing produce false positives during penetration testing?▼

Broken access control testing produces false positives when validation lacks a structured methodology, which is mitigated by using reproducible workflows and controlled-account comparison to confirm findings.

What are the limitations of using controlled accounts for BFLA vulnerability detection?▼

Using controlled accounts for BFLA vulnerability detection limits testing to the specific roles and permissions configured, requiring reversible data to safely validate bypassing authorization without impacting production data.