Generate a Laravel module with an IDOR vulnerability for student grades.
npx skills add https://github.com/Fatt1/ANMMT --skill create-vuln-grades
Please help me install this Agent Skill. Skill: create-vuln-grades Source: https://github.com/Fatt1/ANMMT/tree/main/.github/skills/create-vuln-grades Command: npx skills add https://github.com/Fatt1/ANMMT --skill create-vuln-grades
This Skill automates the creation of an intentionally vulnerable "View Grades" module in a Laravel application, specifically designed to demonstrate Insecure Direct Object Reference (IDOR) vulnerabilities for security training.
Grade::find($id) without proper authorization checks, allowing any authenticated user to view any student's grades.Use the create-vuln-grades skill to scaffold the grades controller, grades route, and grades view.
High-intent search queries and answers about installing and using this skill.
To create an IDOR vulnerability in Laravel, you can scaffold a controller using `Grade::find($id)` without ownership checks. This allows any authenticated user to view other students' grades by changing the URL ID parameter.
IDOR in Laravel routes occurs when a controller fetches a model directly by its ID without verifying the authenticated user's ownership. It allows attackers to access unauthorized data by manipulating route parameters.
You can scaffold a vulnerable grades module to generate a Laravel migration, model, controller, and Tailwind CSS blade view. The generated code intentionally marks the broken access control line for CTF training.
Yes, this scaffolding tool generates a Tailwind CSS blade view for displaying student grades. It creates the complete module alongside the vulnerable controller and migration.
Yes, you can use this to demonstrate OWASP A01:2021 Broken Access Control. It specifically generates a Laravel grades module lacking authorization checks, directly targeting the IDOR vulnerability class.
Fatt1Generate a Laravel 11 login module with SQL injection vulnerability.
SivanwolDefine Laravel authorization policies with standard and custom action methods.
allsmogIdentify web vulnerability patterns and exploitation flows for whitebox penetration testing.
sasabajicEnforce Laravel security best practices for validation, authorization, and data handling.