skills.rest
riandeoliveira
riandeoliveiraCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

testing-for-broken-access-control

Detect broken access control in web applications and APIs.

Updated Jan 29, 2024
Search Tags:#owasp#penetration testing#rbac#idor#broken access control#authorization testing#multi-tenant security
One-click install
npx skills add https://github.com/riandeoliveira/aspnet-template --skill testing-for-broken-access-control-riandeoliveira
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: testing-for-broken-access-control
Source: https://github.com/riandeoliveira/aspnet-template/tree/main/.claude/skills/testing-for-broken-access-control
Command: npx skills add https://github.com/riandeoliveira/aspnet-template --skill testing-for-broken-access-control-riandeoliveira

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, json, argparse, urllib3, datetime, urllib.parse, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Broken access control lets users bypass authorization checks and reach data or actions they should not be allowed to access, turning RBAC/tenant protections into a serious breach risk.

Core Features & Use Cases

  • Vertical privilege escalation testing: Verify lower-privileged users cannot access admin-only endpoints and privileged functionality.
  • Horizontal privilege escalation (IDOR) testing: Check whether users can access or modify other users’ resources by manipulating object identifiers.
  • Function-level and multi-tenant access control checks: Confirm both protected features and tenant boundaries are enforced server-side.

Use case: A SaaS application has role-based and tenant-based restrictions; run this assessment to detect endpoints and API routes where authorization is missing, inconsistent, or relies on client-controlled identifiers.

Quick Start

Run the built-in agent against your authorized target to generate an access control assessment report, specifying the base URL and an authenticated regular-user token.

Frequently Asked Questions about testing-for-broken-access-control

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for IDOR and broken access control in a multi-tenant application?▼

Testing vertical privilege escalation involves verifying that lower-privileged users cannot access admin-only endpoints. You can assess this by running deterministic request checks using Bearer-token authorization against specified target endpoints to detect missing authorization inconsistencies.

Can I use Bearer tokens to check for missing function-level authorization in APIs?▼

Testing authorization in role-based systems requires probing for both vertical and horizontal privilege escalation. This Skill performs deterministic request checks across authenticated and unauthenticated contexts to verify that RBAC protections and tenant boundaries are enforced server-side.

What do I need to run an access control assessment on my web application?▼

To run an access control assessment, you need Python dependencies like requests, urllib3, and argparse. You must provide the base URL of your authorized target and an authenticated regular-user token to generate the access control assessment report.

How are the results from an authorization testing scan reported?▼

Results from authorization testing are reported as structured findings and a JSON report. This output is generated from deterministic request checks that probe endpoints for vertical, horizontal, and function-level access control flaws.

Related Skills

Explore More Legal & Compliance Skills→
williamwang25williamwang25

auth-http-api-cloudbase

Access CloudBase Auth v2 HTTP endpoints for authentication and token management.

Community
Intermediate
matteocervellimatteocervelli
25

planning-doc-generator

Generate project assessment Markdown reports from structured JSON data.

Community
Intermediate
AcczdyAcczdy
2

testing-for-broken-access-control

Detect broken access control by replaying requests across authentication contexts.

Community
Intermediate
n4igmen4igme

vuln-access-control

Identify access-control vulnerabilities in API and web endpoints.

Community
Advanced