What problem does it solve? Authenticated business features (OA, CRM, e-commerce, workflow apps) hide high-impact flaws like horizontal privilege escalation, payment state manipulation, and stored XSS that generic scanners miss. This Skill turns 113 field-tested action fragments into a repeatable methodology for systematically walking every authenticated function point. ## Core Features & Use Cases - Four-Question Framework: For every function point, ask whether the server trusts a value, whether limits are frontend-only, whether object IDs can be swapped (IDOR), and whether content is re-rendered (XSS), with prioritized attack actions per question. - Path Discovery & Enumeration: Covers hidden routes, half-authenticated endpoint fuzzing (401 vs 404 differential), cookie/session creation analysis, and same-vendor pattern migration to map the authenticated attack surface before testing. - Payment & Privilege State Machines: Documents type-flipping, order ID substitution, free-channel-to-paid-content access, and concurrency abuse against quotas, with explicit compliance thresholds (e.g., max 5 IDOR proof records, 0.01-value test payments). - Use Case: Given a target CRM with test accounts in scope, walk each menu operation, capture request/response pairs, swap userId/orgId parameters between two accounts, and log findings as structured FINDING lines with request/response evidence. ## Quick Start Activate this skill when the BRIEF contains test accounts or cookies and the target is in the linkage or deep phase, then walk each authenticated function point through the four-question framework.
