hunt-write-gap

What problem does it solve?

Many APIs have broken access control where read operations are properly protected by authentication and authorization, but write operations (PATCH, POST, DELETE) are left unguarded. This allows authenticated attackers to modify data they should not have access to, such as upgrading account tiers, manipulating balances, or altering other users' information, leading to critical privilege escalation and data integrity risks.

Core Features & Use Cases

• Writeable Endpoint Discovery: Tests common API paths with write methods to identify endpoints that accept modifications.
• Self-Modification Write Gap Testing: Checks if authenticated users can alter their own privileged data (account tiers, usage limits, balances) beyond their authorized permissions.
• Cross-User IDOR Write Testing: Detects if attackers can modify other users' data by adjusting request filters, a critical insecure direct object reference vulnerability.
• Use Case: Ideal for penetration testers assessing Supabase, Firebase, REST, or GraphQL APIs during security audits to uncover high-severity access control flaws that could lead to full account takeover or business logic bypass.

Quick Start

Use the hunt-write-gap skill to test your authenticated target API for unprotected write endpoints that allow unauthorized modification of user account data, tiers, and settings.