skills.rest
devtint
devtintCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

privilege-escalation

Tests API authorization for vertical, horizontal, and role-bypass privilege escalation vulnerabilities.

Updated Feb 23, 2026
Search Tags:#authorization#access control#rbac#privilege escalation#api security#idor
One-click install
npx skills add https://github.com/devtint/API_PENTEST --skill privilege-escalation-devtint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: privilege-escalation
Source: https://github.com/devtint/API_PENTEST/tree/main/testing/SKILLS/privilege-escalation
Command: npx skills add https://github.com/devtint/API_PENTEST --skill privilege-escalation-devtint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies critical authorization flaws in APIs that allow unauthorized users to gain higher privilege levels or access other users' data.

Core Features & Use Cases

  • Vertical Escalation: Test if a regular user can access admin functions or impersonate an admin.
  • Horizontal Escalation: Check if a user can access or modify data belonging to other users.
  • Use Case: When testing an e-commerce API, use this Skill to see if a regular customer can access admin endpoints to view all user data or modify other customers' orders.

Quick Start

Use the privilege-escalation skill to test if the current user token can access the '/api/admin/users' endpoint.

Frequently Asked Questions about privilege-escalation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test an API for privilege escalation vulnerabilities?▼

API authorization testing for privilege escalation checks if regular users can access admin endpoints, access other users' data (horizontal escalation), or bypass role restrictions using authenticated tokens across multiple user accounts.

What is the difference between vertical and horizontal privilege escalation in API security?▼

Vertical privilege escalation tests if a regular user can access admin functions, while horizontal escalation checks if a user can access or modify data belonging to other users, both representing critical access control failures in multi-role applications.

How do I test IDOR and role bypass vulnerabilities in multi-role applications?▼

Testing for IDOR and role bypass requires authenticated access and multiple user accounts to comprehensively verify if existing roles or permissions can be circumvented to access unauthorized API endpoints or data objects.

Do I need multiple user accounts to test API access control effectively?▼

Yes, comprehensive API access control testing requires authenticated access and multiple user accounts to accurately simulate vertical escalation, horizontal escalation, and role bypass scenarios across different privilege levels.

When should I test RBAC implementations for authorization flaws?▼

You should test RBAC implementations when working with multi-role applications, when specific roles or permissions exist, or when you need to verify that API access control properly restricts user-to-admin or user-to-user data access.

Related Skills

Explore More Software Engineering Skills→
wangzeping114wangzeping114

epic-1-auth

Authenticate users with JWT tokens and role-based permissions.

Community
Advanced
jeremylongshorejeremylongshore
2.6k

auditing-access-control

Audit access-control configurations and generate findings reports with remediation guidance.

Community
Advanced
matteocervellimatteocervelli
25

whitelist-bypass-skill

Test tool whitelist restrictions by attempting unauthorized access.

Community
Basic
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced