hunt-broken-function-level-auth

What problem does it solve?

This Skill addresses the risk of unauthorized privilege escalation in role-based access control (RBAC) APIs, where attackers can invoke administrative or privileged actions they are not authorized to perform via overlooked attack vectors like HTTP verb drift, legacy shadow routes, or inconsistent transport protocol authorization.

Core Features & Use Cases

• HTTP Verb Drift Detection: Identifies endpoints where different HTTP methods (GET, POST, PUT, DELETE, custom methods) have mismatched authorization enforcement, allowing low-privilege users to access admin actions via unguarded methods.
• Shadow Route Discovery: Finds legacy, deprecated, or unlisted API paths (e.g., /api/v0/, /api/internal/) that bypass modern middleware authorization checks.
• Transport Protocol Gap Testing: Validates authorization parity across REST, GraphQL, WebSocket, and gRPC interfaces to catch bypasses where non-REST transports skip standard access controls.
• Use Case: A red teamer testing a customer-facing SaaS API with admin, moderator, and user roles can use this Skill to confirm if regular users can delete other user accounts, modify system settings, or access internal job endpoints without proper role validation.

Quick Start

Use the hunt-broken-function-level-auth skill to test your target API for broken function-level authorization by running the full detection workflow covering verb drift, shadow routes, feature flag bypasses, and transport protocol gaps.