salesforce-aura-testing

What problem does it solve?

Security testers frequently miss critical guest user write permissions on Salesforce Experience Cloud Aura endpoints because they only test read access, leading to underreported severity findings and missed bounty opportunities. Read and write permissions are configured independently in Salesforce, so a successful read test does not indicate that write operations are blocked for guest users.

Core Features & Use Cases

• Independent CRUD Permission Testing: Guides testers to evaluate Create, Read, Update, and Delete operations separately for every object type exposed via unauthenticated Aura endpoints, eliminating the common oversight of only testing reads.
• High-Value Object Prioritization: Ranks objects by typical bug bounty value (including Case, Contact, Lead, custom objects, and file-related objects) to focus testing efforts on the most likely misconfigured permissions first.
• Clear Response Interpretation: Provides a reference for interpreting Aura endpoint responses to distinguish between controller access restrictions, record-level denies, and exploitable guest permissions, including the critical note that a read "inaccessible" response does not preclude successful write operations.
• Use Case: During a red team engagement against a client's Salesforce Experience Cloud site, use this skill to systematically test all guest-accessible objects and uncover hidden Case creation permissions that would be missed by only testing read access, resulting in a valid medium-severity finding.

Quick Start

Use the salesforce-aura-testing skill to enumerate all guest CRUD permissions for objects exposed by the unauthenticated Aura endpoint at your target Salesforce community URL.