[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GS3PDKP4VNWRVYXDZV0DG":3,"skill-same:01M71GS3PDKP4VNWRVYXDZV0DG":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":6,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M71GS3PDKP4VNWRVYXDZV0DG","auth-bac-harden",null,"Systematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fauth\u002Fbac\u002Fharden\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"auth bac harden","harden","auth","web-application-security","Access Control","penetration","sonnet","direct","security","owasp","read","privilege escalation","de","references","Bash","access","cybersecurity","testing","cm","broken","2026-11-10 10:12:30",false,"---\nname: auth-bac-harden\ndescription: Systematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- access-control\n- authorization\n- owasp\n- privilege-escalation\n- web-security\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1068\ncwe:\n- CWE-269\ncapec: []\n---\n\n# Testing for Broken Access Control\n\n## When to Use\n\n- During authorized penetration tests as the primary assessment for OWASP A01:2021 - Broken Access Control\n- When evaluating role-based access control (RBAC) implementations across all application endpoints\n- For testing multi-tenant applications where users in one organization should not access another's data\n- When assessing API endpoints for missing or inconsistent authorization checks\n- During security audits where privilege escalation and unauthorized access are primary concerns\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: With Authorize extension for automated access control testing\n- **Multiple test accounts**: Accounts at each role level (admin, manager, user, guest)\n- **Application role matrix**: Documentation of what each role should and should not access\n- **curl\u002Fhttpie**: For manual endpoint testing with different authentication contexts\n- **ffuf**: For discovering hidden endpoints that may lack access controls\n\n## Workflow\n\n### Step 1: Map All Endpoints and Create Access Control Matrix\n\nDocument every endpoint and the expected access level for each role.\n\n```bash\n# Extract all endpoints from Burp Site Map\n# Target > Site Map > Right-click > Copy URLs in this host\n\n# Build a matrix of endpoints vs roles:\n# | Endpoint              | Admin | Manager | User | Guest |\n# |-----------------------|-------|---------|------|-------|\n# | GET \u002Fadmin\u002Fdashboard  | Allow | Deny    | Deny | Deny  |\n# | GET \u002Fapi\u002Fusers        | Allow | Allow   | Deny | Deny  |\n# | PUT \u002Fapi\u002Fusers\u002F{id}   | Allow | Deny    | Own  | Deny  |\n# | DELETE \u002Fapi\u002Fposts\u002F{id} | Allow | Allow   | Own  | Deny  |\n\n# Discover hidden endpoints\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-directories.txt \\\n  -mc 200,301,302,403 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -o endpoints.json -of json\n\n# API endpoint discovery\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fv1\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,302,401,403,405 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\"\n```\n\n### Step 2: Configure Automated Access Control Testing\n\nSet up Burp Authorize extension for parallel role-based testing.\n\n```\n# Install Authorize extension:\n# Burp > Extender > BApp Store > Search \"Authorize\" > Install\n\n# Configuration for three-tier testing:\n# 1. Browse the application as Admin (capture all requests)\n# 2. In Authorize tab:\n#    a. Add Regular User's session token in \"Replace cookies\u002Fheaders\"\n#    b. Optionally add a second row for Unauthenticated (no auth header)\n\n# Example header replacement setup:\n# Row 1 (Low-privilege user):\n#   Cookie: session=low_priv_user_session\n#   Authorization: Bearer low_priv_token\n#\n# Row 2 (Unauthenticated):\n#   [Empty - removes all auth headers]\n\n# Enable interception in Authorize:\n# - Check \"Intercept requests from Proxy\"\n# - Check \"Intercept requests from Repeater\"\n\n# Authorize shows results as:\n# Green  = Properly restricted (different response for different user)\n# Red    = POTENTIALLY VULNERABLE (same response regardless of role)\n# Orange = Uncertain (needs manual verification)\n```\n\n### Step 3: Test Vertical Privilege Escalation\n\nAttempt to access higher-privilege functionality with lower-privilege accounts.\n\n```bash\n# Collect tokens for each role\nADMIN_TOKEN=\"Bearer admin_jwt_here\"\nMANAGER_TOKEN=\"Bearer manager_jwt_here\"\nUSER_TOKEN=\"Bearer user_jwt_here\"\n\n# Test admin endpoints with user token\nADMIN_ENDPOINTS=(\n  \"GET \u002Fadmin\u002Fdashboard\"\n  \"GET \u002Fadmin\u002Fusers\"\n  \"POST \u002Fadmin\u002Fusers\u002Fcreate\"\n  \"PUT \u002Fadmin\u002Fsettings\"\n  \"DELETE \u002Fadmin\u002Fusers\u002F5\"\n  \"GET \u002Fadmin\u002Flogs\"\n  \"GET \u002Fadmin\u002Freports\u002Fexport\"\n  \"POST \u002Fadmin\u002Fbackup\"\n)\n\nfor entry in \"${ADMIN_ENDPOINTS[@]}\"; do\n  method=$(echo \"$entry\" | cut -d' ' -f1)\n  endpoint=$(echo \"$entry\" | cut -d' ' -f2)\n  echo -n \"$method $endpoint (as user): \"\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\")\n  if [ \"$status\" == \"200\" ] || [ \"$status\" == \"201\" ]; then\n    echo \"VULNERABLE ($status)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test with method override headers\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -X POST \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"X-HTTP-Method-Override: DELETE\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\u002F5\"\n\n# Test with different HTTP methods\nfor method in GET POST PUT PATCH DELETE OPTIONS HEAD; do\n  echo -n \"$method \u002Fadmin\u002Fusers: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\"\n  echo\ndone\n```\n\n### Step 4: Test Horizontal Privilege Escalation\n\nVerify that users cannot access resources belonging to other users at the same privilege level.\n\n```bash\n# User A (ID: 101) testing access to User B's (ID: 102) resources\nUSER_A_TOKEN=\"Bearer user_a_jwt\"\n\nRESOURCES=(\n  \"\u002Fapi\u002Fusers\u002F102\u002Fprofile\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Forders\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fmessages\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fdocuments\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fsettings\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fpayment-methods\"\n)\n\nfor resource in \"${RESOURCES[@]}\"; do\n  echo -n \"GET $resource: \"\n  response=$(curl -s -w \"\\n%{http_code}\" \\\n    -H \"Authorization: $USER_A_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com$resource\")\n  status=$(echo \"$response\" | tail -1)\n  body_len=$(echo \"$response\" | head -n -1 | wc -c)\n  if [ \"$status\" == \"200\" ] && [ \"$body_len\" -gt 50 ]; then\n    echo \"VULNERABLE ($status, $body_len bytes)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test write operations across users\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\":\"Hacked\",\"email\":\"hacked@evil.com\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fprofile\" -w \"%{http_code}\"\n\n# Test delete operations\ncurl -s -X DELETE \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fdocuments\u002F1\" -w \"%{http_code}\"\n```\n\n### Step 5: Test Function-Level Access Control\n\nVerify that specific functions enforce authorization properly.\n\n```bash\n# Test unauthenticated access to protected endpoints\nPROTECTED_ENDPOINTS=(\n  \"\u002Fapi\u002Fuser\u002Fprofile\"\n  \"\u002Fapi\u002Ftransactions\"\n  \"\u002Fapi\u002Fsettings\"\n  \"\u002Fadmin\u002Fdashboard\"\n  \"\u002Fapi\u002Fexport\u002Fusers\"\n)\n\nfor endpoint in \"${PROTECTED_ENDPOINTS[@]}\"; do\n  echo -n \"No auth: GET $endpoint: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\"\n  echo\ndone\n\n# Test with expired\u002Finvalid tokens\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -H \"Authorization: Bearer invalid_token_here\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Test role manipulation in JWT claims\n# If JWT contains role claim, try modifying it\n# (requires JWT vulnerability - see JWT testing skill)\n\n# Test parameter-based role escalation\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"role\":\"admin\",\"is_admin\":true,\"permissions\":[\"admin\",\"superuser\"]}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F101\u002Fprofile\"\n\n# Test registration with elevated role\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"new@test.com\",\"password\":\"Test123!\",\"role\":\"admin\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fauth\u002Fregister\"\n```\n\n### Step 6: Test Multi-Tenant Isolation\n\nVerify that tenant boundaries are enforced in multi-tenant applications.\n\n```bash\n# User in Tenant A testing access to Tenant B's resources\nTENANT_A_TOKEN=\"Bearer tenant_a_user_jwt\"\n\n# Direct tenant resource access\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fusers\" | jq .\n\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fsettings\" | jq .\n\n# Test tenant switching via header\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"X-Tenant-ID: tenant-b-id\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq .\n\n# Test tenant ID in request body\ncurl -s -X POST \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"tenant_id\":\"tenant-b-id\",\"query\":\"SELECT * FROM users\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Freports\u002Fcustom\"\n\n# Enumerate tenant IDs\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002FFUZZ\" \\\n  -w \u003C(seq 1 100) \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -mc 200 -t 10 -rate 20\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Vertical Privilege Escalation** | Lower-privilege user accessing higher-privilege functionality (user -> admin) |\n| **Horizontal Privilege Escalation** | User accessing another user's resources at the same privilege level |\n| **Function-Level Access Control** | Authorization checks on specific features\u002Ffunctions regardless of URL |\n| **RBAC** | Role-Based Access Control - permissions assigned to roles, roles assigned to users |\n| **ABAC** | Attribute-Based Access Control - permissions based on user\u002Fresource\u002Fenvironment attributes |\n| **Multi-Tenant Isolation** | Ensuring data and functionality separation between different organizations\u002Ftenants |\n| **Insecure Direct Object Reference** | Accessing objects by manipulating identifiers without authorization checks |\n| **Missing Function-Level Check** | Endpoint exists but does not verify the caller has permission to invoke it |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Request interception and role-based testing |\n| **Authorize (Burp Extension)** | Automated access control testing across sessions |\n| **AutoRepeater (Burp Extension)** | Automatically replays requests with different auth contexts |\n| **Postman** | API testing with environment switching between roles |\n| **ffuf** | Discovering hidden endpoints that may lack access controls |\n| **OWASP ZAP** | Access control testing with context-aware scanning |\n\n## Common Scenarios\n\n### Scenario 1: Admin Panel Without Auth Check\nThe `\u002Fadmin\u002Fdashboard` endpoint returns the admin panel when accessed with a regular user's session token. The front-end hides the admin menu, but the back-end does not enforce role checks.\n\n### Scenario 2: API Endpoint Missing Authorization\nThe `DELETE \u002Fapi\u002Fusers\u002F{id}` endpoint checks for authentication (valid token) but not authorization (admin role). Any authenticated user can delete any other user's account.\n\n### Scenario 3: Tenant Data Leakage\nA SaaS application uses `tenant_id` in API request headers. Changing the `X-Tenant-ID` header to another tenant's ID returns their data, bypassing tenant isolation.\n\n### Scenario 4: Mass Assignment Role Escalation\nThe user profile update endpoint at `PUT \u002Fapi\u002Fusers\u002F{id}` accepts a `role` field in the JSON body. Submitting `\"role\":\"admin\"` alongside a profile update elevates the user to administrator.\n\n## Output Format\n\n```\n## Broken Access Control Assessment Report\n\n**Target**: target.example.com\n**Assessment Date**: 2024-01-15\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### Access Control Matrix Results\n| Endpoint | Admin | Manager | User | Guest | Expected | Actual |\n|----------|-------|---------|------|-------|----------|--------|\n| GET \u002Fadmin\u002Fdashboard | 200 | 200 | 200 | 302 | Admin only | FAIL |\n| DELETE \u002Fapi\u002Fusers\u002F{id} | 200 | 200 | 200 | 401 | Admin only | FAIL |\n| GET \u002Fapi\u002Fusers\u002Fother\u002Fprofile | 200 | 200 | 200 | 401 | Own only | FAIL |\n| PUT \u002Fapi\u002Fusers\u002Fother\u002Fsettings | 200 | 200 | 200 | 401 | Own only | FAIL |\n| GET \u002Fapi\u002Forg\u002Fother-tenant | 200 | 200 | 200 | 401 | Same tenant | FAIL |\n\n### Critical Findings\n1. **Vertical Escalation**: Regular users can access \u002Fadmin\u002F* endpoints\n2. **Horizontal IDOR**: Users can read\u002Fmodify other users' profiles\n3. **Tenant Isolation**: Cross-tenant data access via header manipulation\n4. **Mass Assignment**: Role escalation via profile update endpoint\n\n### Impact\n- Complete administrative access for any authenticated user\n- Full user data access across all accounts (15,000+ users)\n- Cross-tenant data breach affecting 200+ organizations\n- Account takeover via profile modification\n\n### Recommendation\n1. Implement server-side authorization checks on every endpoint\n2. Use a centralized authorization middleware\u002Fframework\n3. Enforce object-level authorization (verify ownership before access)\n4. Validate tenant context server-side, never from client headers\n5. Use allowlists for mass assignment (only permit expected fields)\n6. Implement audit logging for all access control decisions\n```\n","# Testing for Broken Access Control\n\n## When to Use\n\n- During authorized penetration tests as the primary assessment for OWASP A01:2021 - Broken Access Control\n- When evaluating role-based access control (RBAC) implementations across all application endpoints\n- For testing multi-tenant applications where users in one organization should not access another's data\n- When assessing API endpoints for missing or inconsistent authorization checks\n- During security audits where privilege escalation and unauthorized access are primary concerns\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: With Authorize extension for automated access control testing\n- **Multiple test accounts**: Accounts at each role level (admin, manager, user, guest)\n- **Application role matrix**: Documentation of what each role should and should not access\n- **curl\u002Fhttpie**: For manual endpoint testing with different authentication contexts\n- **ffuf**: For discovering hidden endpoints that may lack access controls\n\n## Workflow\n\n### Step 1: Map All Endpoints and Create Access Control Matrix\n\nDocument every endpoint and the expected access level for each role.\n\n```bash\n# Extract all endpoints from Burp Site Map\n# Target > Site Map > Right-click > Copy URLs in this host\n\n# Build a matrix of endpoints vs roles:\n# | Endpoint              | Admin | Manager | User | Guest |\n# |-----------------------|-------|---------|------|-------|\n# | GET \u002Fadmin\u002Fdashboard  | Allow | Deny    | Deny | Deny  |\n# | GET \u002Fapi\u002Fusers        | Allow | Allow   | Deny | Deny  |\n# | PUT \u002Fapi\u002Fusers\u002F{id}   | Allow | Deny    | Own  | Deny  |\n# | DELETE \u002Fapi\u002Fposts\u002F{id} | Allow | Allow   | Own  | Deny  |\n\n# Discover hidden endpoints\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-directories.txt \\\n  -mc 200,301,302,403 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -o endpoints.json -of json\n\n# API endpoint discovery\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fv1\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,302,401,403,405 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\"\n```\n\n### Step 2: Configure Automated Access Control Testing\n\nSet up Burp Authorize extension for parallel role-based testing.\n\n```\n# Install Authorize extension:\n# Burp > Extender > BApp Store > Search \"Authorize\" > Install\n\n# Configuration for three-tier testing:\n# 1. Browse the application as Admin (capture all requests)\n# 2. In Authorize tab:\n#    a. Add Regular User's session token in \"Replace cookies\u002Fheaders\"\n#    b. Optionally add a second row for Unauthenticated (no auth header)\n\n# Example header replacement setup:\n# Row 1 (Low-privilege user):\n#   Cookie: session=low_priv_user_session\n#   Authorization: Bearer low_priv_token\n#\n# Row 2 (Unauthenticated):\n#   [Empty - removes all auth headers]\n\n# Enable interception in Authorize:\n# - Check \"Intercept requests from Proxy\"\n# - Check \"Intercept requests from Repeater\"\n\n# Authorize shows results as:\n# Green  = Properly restricted (different response for different user)\n# Red    = POTENTIALLY VULNERABLE (same response regardless of role)\n# Orange = Uncertain (needs manual verification)\n```\n\n### Step 3: Test Vertical Privilege Escalation\n\nAttempt to access higher-privilege functionality with lower-privilege accounts.\n\n```bash\n# Collect tokens for each role\nADMIN_TOKEN=\"Bearer admin_jwt_here\"\nMANAGER_TOKEN=\"Bearer manager_jwt_here\"\nUSER_TOKEN=\"Bearer user_jwt_here\"\n\n# Test admin endpoints with user token\nADMIN_ENDPOINTS=(\n  \"GET \u002Fadmin\u002Fdashboard\"\n  \"GET \u002Fadmin\u002Fusers\"\n  \"POST \u002Fadmin\u002Fusers\u002Fcreate\"\n  \"PUT \u002Fadmin\u002Fsettings\"\n  \"DELETE \u002Fadmin\u002Fusers\u002F5\"\n  \"GET \u002Fadmin\u002Flogs\"\n  \"GET \u002Fadmin\u002Freports\u002Fexport\"\n  \"POST \u002Fadmin\u002Fbackup\"\n)\n\nfor entry in \"${ADMIN_ENDPOINTS[@]}\"; do\n  method=$(echo \"$entry\" | cut -d' ' -f1)\n  endpoint=$(echo \"$entry\" | cut -d' ' -f2)\n  echo -n \"$method $endpoint (as user): \"\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\")\n  if [ \"$status\" == \"200\" ] || [ \"$status\" == \"201\" ]; then\n    echo \"VULNERABLE ($status)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test with method override headers\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -X POST \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"X-HTTP-Method-Override: DELETE\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\u002F5\"\n\n# Test with different HTTP methods\nfor method in GET POST PUT PATCH DELETE OPTIONS HEAD; do\n  echo -n \"$method \u002Fadmin\u002Fusers: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\"\n  echo\ndone\n```\n\n### Step 4: Test Horizontal Privilege Escalation\n\nVerify that users cannot access resources belonging to other users at the same privilege level.\n\n```bash\n# User A (ID: 101) testing access to User B's (ID: 102) resources\nUSER_A_TOKEN=\"Bearer user_a_jwt\"\n\nRESOURCES=(\n  \"\u002Fapi\u002Fusers\u002F102\u002Fprofile\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Forders\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fmessages\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fdocuments\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fsettings\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fpayment-methods\"\n)\n\nfor resource in \"${RESOURCES[@]}\"; do\n  echo -n \"GET $resource: \"\n  response=$(curl -s -w \"\\n%{http_code}\" \\\n    -H \"Authorization: $USER_A_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com$resource\")\n  status=$(echo \"$response\" | tail -1)\n  body_len=$(echo \"$response\" | head -n -1 | wc -c)\n  if [ \"$status\" == \"200\" ] && [ \"$body_len\" -gt 50 ]; then\n    echo \"VULNERABLE ($status, $body_len bytes)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test write operations across users\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\":\"Hacked\",\"email\":\"hacked@evil.com\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fprofile\" -w \"%{http_code}\"\n\n# Test delete operations\ncurl -s -X DELETE \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fdocuments\u002F1\" -w \"%{http_code}\"\n```\n\n### Step 5: Test Function-Level Access Control\n\nVerify that specific functions enforce authorization properly.\n\n```bash\n# Test unauthenticated access to protected endpoints\nPROTECTED_ENDPOINTS=(\n  \"\u002Fapi\u002Fuser\u002Fprofile\"\n  \"\u002Fapi\u002Ftransactions\"\n  \"\u002Fapi\u002Fsettings\"\n  \"\u002Fadmin\u002Fdashboard\"\n  \"\u002Fapi\u002Fexport\u002Fusers\"\n)\n\nfor endpoint in \"${PROTECTED_ENDPOINTS[@]}\"; do\n  echo -n \"No auth: GET $endpoint: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\"\n  echo\ndone\n\n# Test with expired\u002Finvalid tokens\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -H \"Authorization: Bearer invalid_token_here\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Test role manipulation in JWT claims\n# If JWT contains role claim, try modifying it\n# (requires JWT vulnerability - see JWT testing skill)\n\n# Test parameter-based role escalation\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"role\":\"admin\",\"is_admin\":true,\"permissions\":[\"admin\",\"superuser\"]}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F101\u002Fprofile\"\n\n# Test registration with elevated role\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"new@test.com\",\"password\":\"Test123!\",\"role\":\"admin\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fauth\u002Fregister\"\n```\n\n### Step 6: Test Multi-Tenant Isolation\n\nVerify that tenant boundaries are enforced in multi-tenant applications.\n\n```bash\n# User in Tenant A testing access to Tenant B's resources\nTENANT_A_TOKEN=\"Bearer tenant_a_user_jwt\"\n\n# Direct tenant resource access\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fusers\" | jq .\n\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fsettings\" | jq .\n\n# Test tenant switching via header\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"X-Tenant-ID: tenant-b-id\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq .\n\n# Test tenant ID in request body\ncurl -s -X POST \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"tenant_id\":\"tenant-b-id\",\"query\":\"SELECT * FROM users\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Freports\u002Fcustom\"\n\n# Enumerate tenant IDs\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002FFUZZ\" \\\n  -w \u003C(seq 1 100) \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -mc 200 -t 10 -rate 20\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Vertical Privilege Escalation** | Lower-privilege user accessing higher-privilege functionality (user -> admin) |\n| **Horizontal Privilege Escalation** | User accessing another user's resources at the same privilege level |\n| **Function-Level Access Control** | Authorization checks on specific features\u002Ffunctions regardless of URL |\n| **RBAC** | Role-Based Access Control - permissions assigned to roles, roles assigned to users |\n| **ABAC** | Attribute-Based Access Control - permissions based on user\u002Fresource\u002Fenvironment attributes |\n| **Multi-Tenant Isolation** | Ensuring data and functionality separation between different organizations\u002Ftenants |\n| **Insecure Direct Object Reference** | Accessing objects by manipulating identifiers without authorization checks |\n| **Missing Function-Level Check** | Endpoint exists but does not verify the caller has permission to invoke it |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Request interception and role-based testing |\n| **Authorize (Burp Extension)** | Automated access control testing across sessions |\n| **AutoRepeater (Burp Extension)** | Automatically replays requests with different auth contexts |\n| **Postman** | API testing with environment switching between roles |\n| **ffuf** | Discovering hidden endpoints that may lack access controls |\n| **OWASP ZAP** | Access control testing with context-aware scanning |\n\n## Common Scenarios\n\n### Scenario 1: Admin Panel Without Auth Check\nThe `\u002Fadmin\u002Fdashboard` endpoint returns the admin panel when accessed with a regular user's session token. The front-end hides the admin menu, but the back-end does not enforce role checks.\n\n### Scenario 2: API Endpoint Missing Authorization\nThe `DELETE \u002Fapi\u002Fusers\u002F{id}` endpoint checks for authentication (valid token) but not authorization (admin role). Any authenticated user can delete any other user's account.\n\n### Scenario 3: Tenant Data Leakage\nA SaaS application uses `tenant_id` in API request headers. Changing the `X-Tenant-ID` header to another tenant's ID returns their data, bypassing tenant isolation.\n\n### Scenario 4: Mass Assignment Role Escalation\nThe user profile update endpoint at `PUT \u002Fapi\u002Fusers\u002F{id}` accepts a `role` field in the JSON body. Submitting `\"role\":\"admin\"` alongside a profile update elevates the user to administrator.\n\n## Output Format\n\n```\n## Broken Access Control Assessment Report\n\n**Target**: target.example.com\n**Assessment Date**: 2024-01-15\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### Access Control Matrix Results\n| Endpoint | Admin | Manager | User | Guest | Expected | Actual |\n|----------|-------|---------|------|-------|----------|--------|\n| GET \u002Fadmin\u002Fdashboard | 200 | 200 | 200 | 302 | Admin only | FAIL |\n| DELETE \u002Fapi\u002Fusers\u002F{id} | 200 | 200 | 200 | 401 | Admin only | FAIL |\n| GET \u002Fapi\u002Fusers\u002Fother\u002Fprofile | 200 | 200 | 200 | 401 | Own only | FAIL |\n| PUT \u002Fapi\u002Fusers\u002Fother\u002Fsettings | 200 | 200 | 200 | 401 | Own only | FAIL |\n| GET \u002Fapi\u002Forg\u002Fother-tenant | 200 | 200 | 200 | 401 | Same tenant | FAIL |\n\n### Critical Findings\n1. **Vertical Escalation**: Regular users can access \u002Fadmin\u002F* endpoints\n2. **Horizontal IDOR**: Users can read\u002Fmodify other users' profiles\n3. **Tenant Isolation**: Cross-tenant data access via header manipulation\n4. **Mass Assignment**: Role escalation via profile update endpoint\n\n### Impact\n- Complete administrative access for any authenticated user\n- Full user data access across all accounts (15,000+ users)\n- Cross-tenant data breach affecting 200+ organizations\n- Account takeover via profile modification\n\n### Recommendation\n1. Implement server-side authorization checks on every endpoint\n2. Use a centralized authorization middleware\u002Fframework\n3. Enforce object-level authorization (verify ownership before access)\n4. Validate tenant context server-side, never from client headers\n5. Use allowlists for mass assignment (only permit expected fields)\n6. Implement audit logging for all access control decisions\n```\n",{"cwe":49,"name":5,"tags":51,"capec":57,"model":30,"tools":58,"domain":40,"maxTurns":62,"nist_csf":63,"subdomain":27,"description":7,"mitre_attack":68},[50],"CWE-269",[52,53,54,33,55,56],"penetration-testing","access-control","authorization","privilege-escalation","web-security",[],[59,38,60,61],"Read","Glob","Grep",20,[64,65,66,67],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[69],"T1068","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fweb-application\u002Fauth\u002Fbac\u002Fharden","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill auth-bac-harden",{"tool":83,"command":84},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill auth-bac-harden",{"tool":86,"command":87},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill auth-bac-harden","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fauth\u002Fbac\u002Fharden\u002FSKILL.md",true,[91],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"index.json","REFERENCE","参考文档",659,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fauth\u002Fbac\u002Fharden\u002Findex.json",[98,121,142,163,184,200],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[105,106,107,108,109,36,42,110,111,112,113,114,115,116,117,118,119,40,120],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[128,105,129,108,130,131,132,40,38,133,134,135,136,137,36,138,139,34,140,141],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":148,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[149,150,151,152,153,154,40,38,155,133,156,157,36,34,158,159,160,161,162,30],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[106,170,171,172,173,174,175,42,176,40,120,55,177,178,179,180,181,182,183,36],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[191,192,106,193,172,174,194,42,195,176,40,120,133,196,197,198,199,183,36,110],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":206,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[207,106,172,208,194,42,209,210,40,120,211,212,213,214,215,216,36,110,217,218],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]