create-vuln-grades

Generate a Laravel module with an IDOR vulnerability for student grades.

Updated Mar 5, 2026

Search Tags:#security #vulnerability #owasp #scaffolding #laravel #idor

Ready to run

npx skills add https://github.com/Fatt1/ANMMT --skill create-vuln-grades

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: create-vuln-grades
Source: https://github.com/Fatt1/ANMMT/tree/main/.github/skills/create-vuln-grades
Command: npx skills add https://github.com/Fatt1/ANMMT --skill create-vuln-grades

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates the creation of an intentionally vulnerable "View Grades" module in a Laravel application, specifically designed to demonstrate Insecure Direct Object Reference (IDOR) vulnerabilities for security training.

Core Features & Use Cases

Scaffolds Vulnerable Code: Generates a Laravel Grade model, migration, controller, route, and blade view.
Demonstrates IDOR: The generated controller uses Grade::find($id) without proper authorization checks, allowing any authenticated user to view any student's grades.
Use Case: Use this Skill when instructed to set up the grades viewing functionality for a Capture The Flag (CTF) security lab, focusing on demonstrating broken access control.

Quick Start

Use the create-vuln-grades skill to scaffold the grades controller, grades route, and grades view.

Frequently Asked Questions about create-vuln-grades

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I create an IDOR vulnerability in a Laravel application for a security lab?▼

To create an IDOR vulnerability in Laravel, you can scaffold a controller using `Grade::find($id)` without ownership checks. This allows any authenticated user to view other students' grades by changing the URL ID parameter.

What is Insecure Direct Object Reference (IDOR) in Laravel routes?▼

IDOR in Laravel routes occurs when a controller fetches a model directly by its ID without verifying the authenticated user's ownership. It allows attackers to access unauthorized data by manipulating route parameters.

How do I scaffold a vulnerable grades module for an OWASP CTF challenge?▼

You can scaffold a vulnerable grades module to generate a Laravel migration, model, controller, and Tailwind CSS blade view. The generated code intentionally marks the broken access control line for CTF training.

Does this scaffolding tool generate front-end views with Tailwind CSS?▼

Yes, this scaffolding tool generates a Tailwind CSS blade view for displaying student grades. It creates the complete module alongside the vulnerable controller and migration.

Can I use this to demonstrate OWASP A01:2021 Broken Access Control?▼

Yes, you can use this to demonstrate OWASP A01:2021 Broken Access Control. It specifically generates a Laravel grades module lacking authorization checks, directly targeting the IDOR vulnerability class.