scan-fase-14

Test authenticated web apps for IDOR and privilege escalation vulnerabilities.

Updated Mar 11, 2026

Search Tags:#authorization #graphql #web-security #access-control #privilege-escalation #idor #authenticated-testing

Ready to run

npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-14

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: scan-fase-14
Source: https://github.com/ricardoo022/PentestAI-with-claude-code/tree/main/.claude/skills/scan-fase-14
Command: npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-14

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill guides authenticated security testing to uncover authorization weaknesses, including IDOR vulnerabilities and privilege escalation paths, across modern web applications.

Core Features & Use Cases

Phase-driven, methodical testing workflow that validates access controls across REST, GraphQL, and custom endpoints.
Identifies read/write/delete authorization gaps, unintended data exposure, and admin-route access with supporting evidence and remediation guidance.
Works alongside prerequisite phases (FASE 0, FASE 1-3, FASE 5, FASE 12) to ensure accurate context and reproducibility.

Quick Start

Invoke with /scan-fase-14 {url} after completing prerequisite phases to begin authenticated authorization testing.

Frequently Asked Questions about scan-fase-14

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for IDOR and privilege escalation in authenticated web apps?▼

Authenticated authorization testing for IDOR and privilege escalation requires valid user credentials and prior reconnaissance to locate access-control weaknesses across REST, GraphQL, and custom endpoints. Phase-driven workflows validate these controls methodically.

Does this authorization testing approach work with GraphQL and custom API endpoints?▼

Yes, this authorization testing approach works with GraphQL, REST, and custom endpoints. It applies phase-specific payload patterns and workflows to uncover access-control gaps like unintended data exposure and admin-route access across modern web applications.

What do I need to start authenticated access-control testing?▼

To start authenticated access-control testing, you need valid user credentials for the target multi-user application and completed prior reconnaissance phases. These prerequisites ensure accurate context and reproducible workflows for locating authorization weaknesses.

How does authenticated testing uncover read and write authorization gaps?▼

Authenticated testing uncovers read, write, and delete authorization gaps by applying phase-specific steps and payload patterns against endpoints. It documents vulnerable endpoints, evidence, and remediation guidance for identified access-control weaknesses.

When should I use authenticated authorization testing over unauthenticated scanning?▼

Use authenticated authorization testing when targeting multi-user applications where valid credentials are required to uncover IDOR and privilege escalation vulnerabilities. It identifies unintended data exposure and admin-route access that unauthenticated scanning cannot detect.