What problem does it solve? APIs often enforce authorization at the controller or middleware level, leaving admin actions exposed through alternate HTTP methods, legacy routes, or non-REST transports. This Skill provides a systematic procedure to find endpoints where low-privilege users can invoke admin-only functions. ## Core Features & Use Cases - HTTP Verb Drift Testing: Probe admin endpoints with GET, POST, PUT, PATCH, DELETE, and custom methods like PURGE or DEBUG to find methods lacking role checks. - Route Shadowing & Feature Flag Discovery: Enumerate legacy, beta, and versioned route prefixes with curl and ffuf, and test feature-flag headers that may unlock admin functionality. - Transport Protocol Inconsistency Checks: Compare authorization enforcement across REST, GraphQL mutations, WebSocket messages, and gRPC reflection. - Use Case: During an authorized API penetration test, a tester discovers that DELETE on /api/admin/users returns 403 for normal users, but the same action via a GraphQL mutation succeeds, revealing a function-level authorization flaw. ## Quick Start Test the target API's admin endpoints for broken function-level authorization by probing alternate HTTP methods, legacy routes, and GraphQL mutations with a low-privilege account.
