exploiting-broken-function-level-authorization

What problem does it solve?

This Skill helps identify and test Broken Function Level Authorization (BFLA) vulnerabilities in APIs, where regular users can access admin functions or endpoints without proper authorization.

Core Features & Use Cases

• Endpoint Discovery: Identifies accessible admin endpoints using common patterns.
• Role-Based Testing: Verifies that access controls enforce correct role-based permissions.
• HTTP Method Manipulation: Tests if authorization depends on the HTTP method used.
• Parameter-Based Privilege Escalation: Checks for vulnerabilities through manipulation of request parameters.
• API Version and Path Traversal: Tests older or alternative API versions and path traversal techniques for bypassing authorization.

Quick Start

Run the agent to test BFLA vulnerabilities in your API by providing the base URL and tokens for different user roles.