[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GZTYFYDC7PEDFRGA4G2X2D":3,"skill-same:01M6GZTYFYDC7PEDFRGA4G2X2D":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":62,"install":63,"resources":76},"01M6GZTYFYDC7PEDFRGA4G2X2D","testing-for-broken-access-control",null,"Systematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-for-broken-access-control\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"for","control","Access Control","testing for broken access control","access","testing","broken","direct","object","privilege escalation","penetration","missing","references","application-security","applications","web-application-security","owasp","escalation","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: testing-for-broken-access-control\ndescription: Systematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags: [penetration-testing, access-control, authorization, owasp, privilege-escalation, web-security]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Testing for Broken Access Control\n\n## When to Use\n\n- During authorized penetration tests as the primary assessment for OWASP A01:2021 - Broken Access Control\n- When evaluating role-based access control (RBAC) implementations across all application endpoints\n- For testing multi-tenant applications where users in one organization should not access another's data\n- When assessing API endpoints for missing or inconsistent authorization checks\n- During security audits where privilege escalation and unauthorized access are primary concerns\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: With Authorize extension for automated access control testing\n- **Multiple test accounts**: Accounts at each role level (admin, manager, user, guest)\n- **Application role matrix**: Documentation of what each role should and should not access\n- **curl\u002Fhttpie**: For manual endpoint testing with different authentication contexts\n- **ffuf**: For discovering hidden endpoints that may lack access controls\n\n## Workflow\n\n### Step 1: Map All Endpoints and Create Access Control Matrix\n\nDocument every endpoint and the expected access level for each role.\n\n```bash\n# Extract all endpoints from Burp Site Map\n# Target > Site Map > Right-click > Copy URLs in this host\n\n# Build a matrix of endpoints vs roles:\n# | Endpoint              | Admin | Manager | User | Guest |\n# |-----------------------|-------|---------|------|-------|\n# | GET \u002Fadmin\u002Fdashboard  | Allow | Deny    | Deny | Deny  |\n# | GET \u002Fapi\u002Fusers        | Allow | Allow   | Deny | Deny  |\n# | PUT \u002Fapi\u002Fusers\u002F{id}   | Allow | Deny    | Own  | Deny  |\n# | DELETE \u002Fapi\u002Fposts\u002F{id} | Allow | Allow   | Own  | Deny  |\n\n# Discover hidden endpoints\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-directories.txt \\\n  -mc 200,301,302,403 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -o endpoints.json -of json\n\n# API endpoint discovery\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fv1\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,302,401,403,405 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\"\n```\n\n### Step 2: Configure Automated Access Control Testing\n\nSet up Burp Authorize extension for parallel role-based testing.\n\n```\n# Install Authorize extension:\n# Burp > Extender > BApp Store > Search \"Authorize\" > Install\n\n# Configuration for three-tier testing:\n# 1. Browse the application as Admin (capture all requests)\n# 2. In Authorize tab:\n#    a. Add Regular User's session token in \"Replace cookies\u002Fheaders\"\n#    b. Optionally add a second row for Unauthenticated (no auth header)\n\n# Example header replacement setup:\n# Row 1 (Low-privilege user):\n#   Cookie: session=low_priv_user_session\n#   Authorization: Bearer low_priv_token\n#\n# Row 2 (Unauthenticated):\n#   [Empty - removes all auth headers]\n\n# Enable interception in Authorize:\n# - Check \"Intercept requests from Proxy\"\n# - Check \"Intercept requests from Repeater\"\n\n# Authorize shows results as:\n# Green  = Properly restricted (different response for different user)\n# Red    = POTENTIALLY VULNERABLE (same response regardless of role)\n# Orange = Uncertain (needs manual verification)\n```\n\n### Step 3: Test Vertical Privilege Escalation\n\nAttempt to access higher-privilege functionality with lower-privilege accounts.\n\n```bash\n# Collect tokens for each role\nADMIN_TOKEN=\"Bearer admin_jwt_here\"\nMANAGER_TOKEN=\"Bearer manager_jwt_here\"\nUSER_TOKEN=\"Bearer user_jwt_here\"\n\n# Test admin endpoints with user token\nADMIN_ENDPOINTS=(\n  \"GET \u002Fadmin\u002Fdashboard\"\n  \"GET \u002Fadmin\u002Fusers\"\n  \"POST \u002Fadmin\u002Fusers\u002Fcreate\"\n  \"PUT \u002Fadmin\u002Fsettings\"\n  \"DELETE \u002Fadmin\u002Fusers\u002F5\"\n  \"GET \u002Fadmin\u002Flogs\"\n  \"GET \u002Fadmin\u002Freports\u002Fexport\"\n  \"POST \u002Fadmin\u002Fbackup\"\n)\n\nfor entry in \"${ADMIN_ENDPOINTS[@]}\"; do\n  method=$(echo \"$entry\" | cut -d' ' -f1)\n  endpoint=$(echo \"$entry\" | cut -d' ' -f2)\n  echo -n \"$method $endpoint (as user): \"\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\")\n  if [ \"$status\" == \"200\" ] || [ \"$status\" == \"201\" ]; then\n    echo \"VULNERABLE ($status)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test with method override headers\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -X POST \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"X-HTTP-Method-Override: DELETE\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\u002F5\"\n\n# Test with different HTTP methods\nfor method in GET POST PUT PATCH DELETE OPTIONS HEAD; do\n  echo -n \"$method \u002Fadmin\u002Fusers: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\"\n  echo\ndone\n```\n\n### Step 4: Test Horizontal Privilege Escalation\n\nVerify that users cannot access resources belonging to other users at the same privilege level.\n\n```bash\n# User A (ID: 101) testing access to User B's (ID: 102) resources\nUSER_A_TOKEN=\"Bearer user_a_jwt\"\n\nRESOURCES=(\n  \"\u002Fapi\u002Fusers\u002F102\u002Fprofile\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Forders\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fmessages\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fdocuments\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fsettings\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fpayment-methods\"\n)\n\nfor resource in \"${RESOURCES[@]}\"; do\n  echo -n \"GET $resource: \"\n  response=$(curl -s -w \"\\n%{http_code}\" \\\n    -H \"Authorization: $USER_A_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com$resource\")\n  status=$(echo \"$response\" | tail -1)\n  body_len=$(echo \"$response\" | head -n -1 | wc -c)\n  if [ \"$status\" == \"200\" ] && [ \"$body_len\" -gt 50 ]; then\n    echo \"VULNERABLE ($status, $body_len bytes)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test write operations across users\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\":\"Hacked\",\"email\":\"hacked@evil.com\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fprofile\" -w \"%{http_code}\"\n\n# Test delete operations\ncurl -s -X DELETE \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fdocuments\u002F1\" -w \"%{http_code}\"\n```\n\n### Step 5: Test Function-Level Access Control\n\nVerify that specific functions enforce authorization properly.\n\n```bash\n# Test unauthenticated access to protected endpoints\nPROTECTED_ENDPOINTS=(\n  \"\u002Fapi\u002Fuser\u002Fprofile\"\n  \"\u002Fapi\u002Ftransactions\"\n  \"\u002Fapi\u002Fsettings\"\n  \"\u002Fadmin\u002Fdashboard\"\n  \"\u002Fapi\u002Fexport\u002Fusers\"\n)\n\nfor endpoint in \"${PROTECTED_ENDPOINTS[@]}\"; do\n  echo -n \"No auth: GET $endpoint: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\"\n  echo\ndone\n\n# Test with expired\u002Finvalid tokens\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -H \"Authorization: Bearer invalid_token_here\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Test role manipulation in JWT claims\n# If JWT contains role claim, try modifying it\n# (requires JWT vulnerability - see JWT testing skill)\n\n# Test parameter-based role escalation\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"role\":\"admin\",\"is_admin\":true,\"permissions\":[\"admin\",\"superuser\"]}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F101\u002Fprofile\"\n\n# Test registration with elevated role\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"new@test.com\",\"password\":\"Test123!\",\"role\":\"admin\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fauth\u002Fregister\"\n```\n\n### Step 6: Test Multi-Tenant Isolation\n\nVerify that tenant boundaries are enforced in multi-tenant applications.\n\n```bash\n# User in Tenant A testing access to Tenant B's resources\nTENANT_A_TOKEN=\"Bearer tenant_a_user_jwt\"\n\n# Direct tenant resource access\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fusers\" | jq .\n\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fsettings\" | jq .\n\n# Test tenant switching via header\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"X-Tenant-ID: tenant-b-id\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq .\n\n# Test tenant ID in request body\ncurl -s -X POST \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"tenant_id\":\"tenant-b-id\",\"query\":\"SELECT * FROM users\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Freports\u002Fcustom\"\n\n# Enumerate tenant IDs\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002FFUZZ\" \\\n  -w \u003C(seq 1 100) \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -mc 200 -t 10 -rate 20\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Vertical Privilege Escalation** | Lower-privilege user accessing higher-privilege functionality (user -> admin) |\n| **Horizontal Privilege Escalation** | User accessing another user's resources at the same privilege level |\n| **Function-Level Access Control** | Authorization checks on specific features\u002Ffunctions regardless of URL |\n| **RBAC** | Role-Based Access Control - permissions assigned to roles, roles assigned to users |\n| **ABAC** | Attribute-Based Access Control - permissions based on user\u002Fresource\u002Fenvironment attributes |\n| **Multi-Tenant Isolation** | Ensuring data and functionality separation between different organizations\u002Ftenants |\n| **Insecure Direct Object Reference** | Accessing objects by manipulating identifiers without authorization checks |\n| **Missing Function-Level Check** | Endpoint exists but does not verify the caller has permission to invoke it |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Request interception and role-based testing |\n| **Authorize (Burp Extension)** | Automated access control testing across sessions |\n| **AutoRepeater (Burp Extension)** | Automatically replays requests with different auth contexts |\n| **Postman** | API testing with environment switching between roles |\n| **ffuf** | Discovering hidden endpoints that may lack access controls |\n| **OWASP ZAP** | Access control testing with context-aware scanning |\n\n## Common Scenarios\n\n### Scenario 1: Admin Panel Without Auth Check\nThe `\u002Fadmin\u002Fdashboard` endpoint returns the admin panel when accessed with a regular user's session token. The front-end hides the admin menu, but the back-end does not enforce role checks.\n\n### Scenario 2: API Endpoint Missing Authorization\nThe `DELETE \u002Fapi\u002Fusers\u002F{id}` endpoint checks for authentication (valid token) but not authorization (admin role). Any authenticated user can delete any other user's account.\n\n### Scenario 3: Tenant Data Leakage\nA SaaS application uses `tenant_id` in API request headers. Changing the `X-Tenant-ID` header to another tenant's ID returns their data, bypassing tenant isolation.\n\n### Scenario 4: Mass Assignment Role Escalation\nThe user profile update endpoint at `PUT \u002Fapi\u002Fusers\u002F{id}` accepts a `role` field in the JSON body. Submitting `\"role\":\"admin\"` alongside a profile update elevates the user to administrator.\n\n## Output Format\n\n```\n## Broken Access Control Assessment Report\n\n**Target**: target.example.com\n**Assessment Date**: 2024-01-15\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### Access Control Matrix Results\n| Endpoint | Admin | Manager | User | Guest | Expected | Actual |\n|----------|-------|---------|------|-------|----------|--------|\n| GET \u002Fadmin\u002Fdashboard | 200 | 200 | 200 | 302 | Admin only | FAIL |\n| DELETE \u002Fapi\u002Fusers\u002F{id} | 200 | 200 | 200 | 401 | Admin only | FAIL |\n| GET \u002Fapi\u002Fusers\u002Fother\u002Fprofile | 200 | 200 | 200 | 401 | Own only | FAIL |\n| PUT \u002Fapi\u002Fusers\u002Fother\u002Fsettings | 200 | 200 | 200 | 401 | Own only | FAIL |\n| GET \u002Fapi\u002Forg\u002Fother-tenant | 200 | 200 | 200 | 401 | Same tenant | FAIL |\n\n### Critical Findings\n1. **Vertical Escalation**: Regular users can access \u002Fadmin\u002F* endpoints\n2. **Horizontal IDOR**: Users can read\u002Fmodify other users' profiles\n3. **Tenant Isolation**: Cross-tenant data access via header manipulation\n4. **Mass Assignment**: Role escalation via profile update endpoint\n\n### Impact\n- Complete administrative access for any authenticated user\n- Full user data access across all accounts (15,000+ users)\n- Cross-tenant data breach affecting 200+ organizations\n- Account takeover via profile modification\n\n### Recommendation\n1. Implement server-side authorization checks on every endpoint\n2. Use a centralized authorization middleware\u002Fframework\n3. Enforce object-level authorization (verify ownership before access)\n4. Validate tenant context server-side, never from client headers\n5. Use allowlists for mass assignment (only permit expected fields)\n6. Implement audit logging for all access control decisions\n```\n","# Testing for Broken Access Control\n\n## When to Use\n\n- During authorized penetration tests as the primary assessment for OWASP A01:2021 - Broken Access Control\n- When evaluating role-based access control (RBAC) implementations across all application endpoints\n- For testing multi-tenant applications where users in one organization should not access another's data\n- When assessing API endpoints for missing or inconsistent authorization checks\n- During security audits where privilege escalation and unauthorized access are primary concerns\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: With Authorize extension for automated access control testing\n- **Multiple test accounts**: Accounts at each role level (admin, manager, user, guest)\n- **Application role matrix**: Documentation of what each role should and should not access\n- **curl\u002Fhttpie**: For manual endpoint testing with different authentication contexts\n- **ffuf**: For discovering hidden endpoints that may lack access controls\n\n## Workflow\n\n### Step 1: Map All Endpoints and Create Access Control Matrix\n\nDocument every endpoint and the expected access level for each role.\n\n```bash\n# Extract all endpoints from Burp Site Map\n# Target > Site Map > Right-click > Copy URLs in this host\n\n# Build a matrix of endpoints vs roles:\n# | Endpoint              | Admin | Manager | User | Guest |\n# |-----------------------|-------|---------|------|-------|\n# | GET \u002Fadmin\u002Fdashboard  | Allow | Deny    | Deny | Deny  |\n# | GET \u002Fapi\u002Fusers        | Allow | Allow   | Deny | Deny  |\n# | PUT \u002Fapi\u002Fusers\u002F{id}   | Allow | Deny    | Own  | Deny  |\n# | DELETE \u002Fapi\u002Fposts\u002F{id} | Allow | Allow   | Own  | Deny  |\n\n# Discover hidden endpoints\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-directories.txt \\\n  -mc 200,301,302,403 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -o endpoints.json -of json\n\n# API endpoint discovery\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fv1\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,302,401,403,405 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\"\n```\n\n### Step 2: Configure Automated Access Control Testing\n\nSet up Burp Authorize extension for parallel role-based testing.\n\n```\n# Install Authorize extension:\n# Burp > Extender > BApp Store > Search \"Authorize\" > Install\n\n# Configuration for three-tier testing:\n# 1. Browse the application as Admin (capture all requests)\n# 2. In Authorize tab:\n#    a. Add Regular User's session token in \"Replace cookies\u002Fheaders\"\n#    b. Optionally add a second row for Unauthenticated (no auth header)\n\n# Example header replacement setup:\n# Row 1 (Low-privilege user):\n#   Cookie: session=low_priv_user_session\n#   Authorization: Bearer low_priv_token\n#\n# Row 2 (Unauthenticated):\n#   [Empty - removes all auth headers]\n\n# Enable interception in Authorize:\n# - Check \"Intercept requests from Proxy\"\n# - Check \"Intercept requests from Repeater\"\n\n# Authorize shows results as:\n# Green  = Properly restricted (different response for different user)\n# Red    = POTENTIALLY VULNERABLE (same response regardless of role)\n# Orange = Uncertain (needs manual verification)\n```\n\n### Step 3: Test Vertical Privilege Escalation\n\nAttempt to access higher-privilege functionality with lower-privilege accounts.\n\n```bash\n# Collect tokens for each role\nADMIN_TOKEN=\"Bearer admin_jwt_here\"\nMANAGER_TOKEN=\"Bearer manager_jwt_here\"\nUSER_TOKEN=\"Bearer user_jwt_here\"\n\n# Test admin endpoints with user token\nADMIN_ENDPOINTS=(\n  \"GET \u002Fadmin\u002Fdashboard\"\n  \"GET \u002Fadmin\u002Fusers\"\n  \"POST \u002Fadmin\u002Fusers\u002Fcreate\"\n  \"PUT \u002Fadmin\u002Fsettings\"\n  \"DELETE \u002Fadmin\u002Fusers\u002F5\"\n  \"GET \u002Fadmin\u002Flogs\"\n  \"GET \u002Fadmin\u002Freports\u002Fexport\"\n  \"POST \u002Fadmin\u002Fbackup\"\n)\n\nfor entry in \"${ADMIN_ENDPOINTS[@]}\"; do\n  method=$(echo \"$entry\" | cut -d' ' -f1)\n  endpoint=$(echo \"$entry\" | cut -d' ' -f2)\n  echo -n \"$method $endpoint (as user): \"\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\")\n  if [ \"$status\" == \"200\" ] || [ \"$status\" == \"201\" ]; then\n    echo \"VULNERABLE ($status)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test with method override headers\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -X POST \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"X-HTTP-Method-Override: DELETE\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\u002F5\"\n\n# Test with different HTTP methods\nfor method in GET POST PUT PATCH DELETE OPTIONS HEAD; do\n  echo -n \"$method \u002Fadmin\u002Fusers: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\"\n  echo\ndone\n```\n\n### Step 4: Test Horizontal Privilege Escalation\n\nVerify that users cannot access resources belonging to other users at the same privilege level.\n\n```bash\n# User A (ID: 101) testing access to User B's (ID: 102) resources\nUSER_A_TOKEN=\"Bearer user_a_jwt\"\n\nRESOURCES=(\n  \"\u002Fapi\u002Fusers\u002F102\u002Fprofile\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Forders\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fmessages\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fdocuments\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fsettings\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fpayment-methods\"\n)\n\nfor resource in \"${RESOURCES[@]}\"; do\n  echo -n \"GET $resource: \"\n  response=$(curl -s -w \"\\n%{http_code}\" \\\n    -H \"Authorization: $USER_A_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com$resource\")\n  status=$(echo \"$response\" | tail -1)\n  body_len=$(echo \"$response\" | head -n -1 | wc -c)\n  if [ \"$status\" == \"200\" ] && [ \"$body_len\" -gt 50 ]; then\n    echo \"VULNERABLE ($status, $body_len bytes)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test write operations across users\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\":\"Hacked\",\"email\":\"hacked@evil.com\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fprofile\" -w \"%{http_code}\"\n\n# Test delete operations\ncurl -s -X DELETE \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fdocuments\u002F1\" -w \"%{http_code}\"\n```\n\n### Step 5: Test Function-Level Access Control\n\nVerify that specific functions enforce authorization properly.\n\n```bash\n# Test unauthenticated access to protected endpoints\nPROTECTED_ENDPOINTS=(\n  \"\u002Fapi\u002Fuser\u002Fprofile\"\n  \"\u002Fapi\u002Ftransactions\"\n  \"\u002Fapi\u002Fsettings\"\n  \"\u002Fadmin\u002Fdashboard\"\n  \"\u002Fapi\u002Fexport\u002Fusers\"\n)\n\nfor endpoint in \"${PROTECTED_ENDPOINTS[@]}\"; do\n  echo -n \"No auth: GET $endpoint: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\"\n  echo\ndone\n\n# Test with expired\u002Finvalid tokens\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -H \"Authorization: Bearer invalid_token_here\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Test role manipulation in JWT claims\n# If JWT contains role claim, try modifying it\n# (requires JWT vulnerability - see JWT testing skill)\n\n# Test parameter-based role escalation\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"role\":\"admin\",\"is_admin\":true,\"permissions\":[\"admin\",\"superuser\"]}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F101\u002Fprofile\"\n\n# Test registration with elevated role\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"new@test.com\",\"password\":\"Test123!\",\"role\":\"admin\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fauth\u002Fregister\"\n```\n\n### Step 6: Test Multi-Tenant Isolation\n\nVerify that tenant boundaries are enforced in multi-tenant applications.\n\n```bash\n# User in Tenant A testing access to Tenant B's resources\nTENANT_A_TOKEN=\"Bearer tenant_a_user_jwt\"\n\n# Direct tenant resource access\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fusers\" | jq .\n\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fsettings\" | jq .\n\n# Test tenant switching via header\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"X-Tenant-ID: tenant-b-id\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq .\n\n# Test tenant ID in request body\ncurl -s -X POST \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"tenant_id\":\"tenant-b-id\",\"query\":\"SELECT * FROM users\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Freports\u002Fcustom\"\n\n# Enumerate tenant IDs\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002FFUZZ\" \\\n  -w \u003C(seq 1 100) \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -mc 200 -t 10 -rate 20\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Vertical Privilege Escalation** | Lower-privilege user accessing higher-privilege functionality (user -> admin) |\n| **Horizontal Privilege Escalation** | User accessing another user's resources at the same privilege level |\n| **Function-Level Access Control** | Authorization checks on specific features\u002Ffunctions regardless of URL |\n| **RBAC** | Role-Based Access Control - permissions assigned to roles, roles assigned to users |\n| **ABAC** | Attribute-Based Access Control - permissions based on user\u002Fresource\u002Fenvironment attributes |\n| **Multi-Tenant Isolation** | Ensuring data and functionality separation between different organizations\u002Ftenants |\n| **Insecure Direct Object Reference** | Accessing objects by manipulating identifiers without authorization checks |\n| **Missing Function-Level Check** | Endpoint exists but does not verify the caller has permission to invoke it |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Request interception and role-based testing |\n| **Authorize (Burp Extension)** | Automated access control testing across sessions |\n| **AutoRepeater (Burp Extension)** | Automatically replays requests with different auth contexts |\n| **Postman** | API testing with environment switching between roles |\n| **ffuf** | Discovering hidden endpoints that may lack access controls |\n| **OWASP ZAP** | Access control testing with context-aware scanning |\n\n## Common Scenarios\n\n### Scenario 1: Admin Panel Without Auth Check\nThe `\u002Fadmin\u002Fdashboard` endpoint returns the admin panel when accessed with a regular user's session token. The front-end hides the admin menu, but the back-end does not enforce role checks.\n\n### Scenario 2: API Endpoint Missing Authorization\nThe `DELETE \u002Fapi\u002Fusers\u002F{id}` endpoint checks for authentication (valid token) but not authorization (admin role). Any authenticated user can delete any other user's account.\n\n### Scenario 3: Tenant Data Leakage\nA SaaS application uses `tenant_id` in API request headers. Changing the `X-Tenant-ID` header to another tenant's ID returns their data, bypassing tenant isolation.\n\n### Scenario 4: Mass Assignment Role Escalation\nThe user profile update endpoint at `PUT \u002Fapi\u002Fusers\u002F{id}` accepts a `role` field in the JSON body. Submitting `\"role\":\"admin\"` alongside a profile update elevates the user to administrator.\n\n## Output Format\n\n```\n## Broken Access Control Assessment Report\n\n**Target**: target.example.com\n**Assessment Date**: 2024-01-15\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### Access Control Matrix Results\n| Endpoint | Admin | Manager | User | Guest | Expected | Actual |\n|----------|-------|---------|------|-------|----------|--------|\n| GET \u002Fadmin\u002Fdashboard | 200 | 200 | 200 | 302 | Admin only | FAIL |\n| DELETE \u002Fapi\u002Fusers\u002F{id} | 200 | 200 | 200 | 401 | Admin only | FAIL |\n| GET \u002Fapi\u002Fusers\u002Fother\u002Fprofile | 200 | 200 | 200 | 401 | Own only | FAIL |\n| PUT \u002Fapi\u002Fusers\u002Fother\u002Fsettings | 200 | 200 | 200 | 401 | Own only | FAIL |\n| GET \u002Fapi\u002Forg\u002Fother-tenant | 200 | 200 | 200 | 401 | Same tenant | FAIL |\n\n### Critical Findings\n1. **Vertical Escalation**: Regular users can access \u002Fadmin\u002F* endpoints\n2. **Horizontal IDOR**: Users can read\u002Fmodify other users' profiles\n3. **Tenant Isolation**: Cross-tenant data access via header manipulation\n4. **Mass Assignment**: Role escalation via profile update endpoint\n\n### Impact\n- Complete administrative access for any authenticated user\n- Full user data access across all accounts (15,000+ users)\n- Cross-tenant data breach affecting 200+ organizations\n- Account takeover via profile modification\n\n### Recommendation\n1. Implement server-side authorization checks on every endpoint\n2. Use a centralized authorization middleware\u002Fframework\n3. Enforce object-level authorization (verify ownership before access)\n4. Validate tenant context server-side, never from client headers\n5. Use allowlists for mass assignment (only permit expected fields)\n6. Implement audit logging for all access control decisions\n```\n",{"name":5,"tags":48,"author":54,"domain":41,"license":14,"version":55,"subdomain":38,"description":7},[49,50,51,39,52,53],"penetration-testing","access-control","authorization","privilege-escalation","web-security","mahipal","1.0","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-for-broken-access-control",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add micsapp\u002Fmicstec-skills --skill testing-for-broken-access-control",{"tool":69,"command":70},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill testing-for-broken-access-control",{"tool":72,"command":73},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill testing-for-broken-access-control","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-for-broken-access-control\u002FSKILL.md",true,[77,82,88],{"path":78,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-for-broken-access-control\u002FLICENSE",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fapi-reference.md","REFERENCE","参考文档",2001,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-for-broken-access-control\u002Freferences\u002Fapi-reference.md",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Fagent.py","SCRIPT","脚本",8889,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-for-broken-access-control\u002Fscripts\u002Fagent.py",[95,130,160,178,197,222],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":110,"publishedAt":43},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[102,105],{"categoryNo":103,"categoryName":104,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,23],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":144,"publishedAt":43},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[136,137,140,143],{"categoryNo":103,"categoryName":104,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":138,"categoryName":139,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":141,"categoryName":142,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},[145,146,147,148,112,149,150,151,152,153,154,155,120,121,127,156,157,128,158,159],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":167,"publishedAt":43},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[166],{"categoryNo":103,"categoryName":104,"taxonomyType":20,"taxonomyTypeDesc":21},[168,169,170,42,112,115,120,121,27,171,172,173,25,174,175,128,176,177,159,23],"policy","authoring","apim policy authoring","use","ready","api security","error","processing","cors configuration","production-ready",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":186,"publishedAt":43},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[184,185],{"categoryNo":103,"categoryName":104,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},[187,42,188,120,173,189,112,145,190,191,39,192,121,193,128,194,195,196,129,23],"review","security review","api security review","benchmark","verification","owasp-api","alignment","azure security","reviews","top",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":43},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[204,205,206,147,207,208,209,210,120,211,212,213,214,215,216,217,218,219,220,221],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":228,"publishedAt":43},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[224,229,230,231,232,233,234,171,235,236],"npm","js","calculate","node","math","user","compute","errors"]