Detect unprotected write endpoints in authenticated APIs for penetration testing.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-write-gap
Please help me install this Agent Skill. Skill: hunt-write-gap Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-write-gap Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-write-gap
Many APIs have broken access control where read operations are properly protected by authentication and authorization, but write operations (PATCH, POST, DELETE) are left unguarded. This allows authenticated attackers to modify data they should not have access to, such as upgrading account tiers, manipulating balances, or altering other users' information, leading to critical privilege escalation and data integrity risks.
Use the hunt-write-gap skill to test your authenticated target API for unprotected write endpoints that allow unauthorized modification of user account data, tiers, and settings.
High-intent search queries and answers about installing and using this skill.
A write gap vulnerability occurs when read operations are properly protected but write operations like PATCH, POST, or DELETE are left unguarded. This allows authenticated attackers to modify protected data, leading to privilege escalation and data integrity risks.
Detecting IDOR write vulnerabilities in Supabase requires testing if authenticated users can modify other users' data by adjusting request filters. This skill targets Supabase backends to detect cross-user insecure direct object reference flaws during security audits.
Yes, you can test GraphQL backends for self-modification write gaps. This skill checks if authenticated users can alter their own privileged data, such as account tiers or usage limits, beyond their authorized permissions across REST and GraphQL APIs.
The best way to find unprotected write endpoints is to test common API paths with write methods to identify endpoints accepting modifications. This skill automates writable endpoint discovery to assess privilege escalation and data tampering risks.
Yes, this access control testing approach works with Firebase APIs. The skill is designed for penetration testing engagements targeting Supabase, Firebase, custom REST APIs, and GraphQL backends with authenticated user access to uncover high-severity access control flaws.
YlikenDetects and tests API authorization gaps in object access and function controls.
blacklanternsecurityTest ID formats and injection points for IDOR and access control vulnerabilities.
AeonDaveFuzz HTTP endpoints with wordlists to discover directories, parameters, and virtual hosts.
florianbuetowAudit REST and RPC APIs for OWASP API Security Top 10 vulnerabilities.
