[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71H0G777V6H5SVCV3SW0R7A":3,"skill-same:01M71H0G777V6H5SVCV3SW0R7A":66},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":39,"commitSha":40,"skillDirectory":41,"forksCount":14,"repositoryHtmlUrl":42,"repositoryHomepageUrl":6,"ownerHtmlUrl":43,"ownerBlogUrl":6,"ownerDescription":44,"updatedAt":45,"install":46,"resources":59},"01M71H0G777V6H5SVCV3SW0R7A","webapp-api-bfla",null,"Webapp Api Bfla.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-api-bfla\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33],"bfla","api","webapp","webapp api bfla","cybersecurity","2026-11-10 10:12:30",false,"---\nname: webapp-api-bfla\ndescription: \"Webapp Api Bfla.\"\ndomain: cybersecurity\n---\n\n|\n| **BFLA** | Broken Function Level Authorization (OWASP API5:2023) - regular users can invoke administrative or privileged API functions without proper authorization checks |\n| **Vertical Privilege Escalation** | Accessing functions or data restricted to a higher privilege level, such as regular user accessing admin endpoints |\n| **RBAC** | Role-Based Access Control - authorization model where permissions are assigned to roles and roles are assigned to users |\n| **Function-Level Authorization** | Access control checks that verify whether the authenticated user has permission to invoke a specific API function |\n| **Admin Endpoint** | API endpoints intended only for administrative users, typically managing users, settings, audit logs, and system configuration |\n| **Forced Browsing** | Directly accessing URLs that are not linked in the application but exist on the server, bypassing UI-level access restrictions |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Intercept requests as admin, then replay with regular user token to test function-level authorization\n- **OWASP ZAP**: Forced Browse scanner to discover hidden administrative endpoints and test access control\n- **Autorize (Burp Extension)**: Automated BFLA detection by replaying admin requests with regular user credentials\n- **ffuf**: Endpoint discovery tool: `ffuf -u https:\u002F\u002Fapi.example.com\u002Fapi\u002Fv1\u002FFUZZ -w admin-endpoints.txt -H \"Authorization: Bearer user_token\"`\n- **Nuclei**: Template-based scanner with BFLA detection templates for common frameworks\n\n## Common Scenarios\n\n### Scenario: SaaS Multi-Tenant API BFLA Assessment\n\n**Context**: A SaaS platform has user, moderator, and admin roles. The API serves a React frontend that conditionally renders admin features based on the user's role. The backend API should enforce the same restrictions independently.\n\n**Approach**:\n1. Map admin endpoints from the frontend JavaScript bundle: search for `\u002Fadmin\u002F`, `\u002Fmanage\u002F`, and role-check conditionals\n2. Discover 12 admin endpoints including user management, billing, feature flags, and audit logs\n3. Test each admin endpoint with regular user token:\n   - `GET \u002Fapi\u002Fv1\u002Fadmin\u002Fusers` returns 200 with all user data (BFLA - read)\n   - `PUT \u002Fapi\u002Fv1\u002Fadmin\u002Fusers\u002F1002\u002Frole` accepts role change (BFLA - write)\n   - `DELETE \u002Fapi\u002Fv1\u002Faudit\u002Flogs` returns 200 (BFLA - destructive)\n4. Test method-based bypass: `GET \u002Fapi\u002Fv1\u002Fadmin\u002Fsettings` returns 403, but `PUT \u002Fapi\u002Fv1\u002Fadmin\u002Fsettings` returns 200\n5. Find that the moderator role can access all admin endpoints except `DELETE \u002Fapi\u002Fv1\u002Fadmin\u002Fbilling`\n6. Discover `\u002Fapi\u002Fv2\u002Fadmin\u002Fusers` exists without any authorization (shadow API version)\n\n**Pitfalls**:\n- Only testing GET requests on admin endpoints while missing BFLA in POST\u002FPUT\u002FDELETE methods\n- Not discovering admin endpoints because they are not linked in the UI (requires endpoint enumeration)\n- Assuming RBAC is enforced consistently because one admin endpoint returned 403\n- Missing BFLA in internal\u002Fundocumented API endpoints not listed in the OpenAPI specification\n- Not testing with all available role levels (moderator may have partial admin access)\n\n## Output Format\n\n```\n## Finding: Regular Users Can Access Admin User Management API\n\n**ID**: API-BFLA-001\n**Severity**: Critical (CVSS 9.8)\n**OWASP API**: API5:2023 - Broken Function Level Authorization\n**Affected Endpoints**:\n  - GET \u002Fapi\u002Fv1\u002Fadmin\u002Fusers (read all users)\n  - PUT \u002Fapi\u002Fv1\u002Fadmin\u002Fusers\u002F{id}\u002Frole (change user roles)\n  - DELETE \u002Fapi\u002Fv1\u002Faudit\u002Flogs (delete audit trail)\n  - PUT \u002Fapi\u002Fv1\u002Fadmin\u002Fsettings (modify system config)\n\n**Description**:\nThe API does not enforce function-level authorization on administrative\nendpoints. A regular user can directly call admin API endpoints and\nexecute administrative functions including user management, role changes,\nsystem configuration, and audit log deletion. The frontend hides admin\nfeatures based on role, but the backend API does not enforce the same\nrestrictions.\n\n**Proof of Concept**:\n1. Authenticate as regular user: POST \u002Fapi\u002Fv1\u002Fauth\u002Flogin\n2. Call admin endpoint: GET \u002Fapi\u002Fv1\u002Fadmin\u002Fusers -> 200 OK (returns all 50,000 users)\n3. Elevate own role: PUT \u002Fapi\u002Fv1\u002Fadmin\u002Fusers\u002Fme\u002Frole {\"role\":\"admin\"} -> 200 OK\n4. Delete audit logs: DELETE \u002Fapi\u002Fv1\u002Faudit\u002Flogs -> 204 No Content\n\n**Impact**:\nAny authenticated user can take full administrative control of the\nplatform, access all user data, modify roles, change system configuration,\nand delete audit logs to cover their tracks.\n\n**Remediation**:\n1. Implement RBAC middleware that checks user role before executing any admin function\n2. Apply authorization at the route\u002Fcontroller level, not just the frontend\n3. Use decorator\u002Fannotation-based authorization (e.g., @RequireRole(\"admin\"))\n4. Add automated BFLA tests to the CI\u002FCD pipeline that test every endpoint with every role\n5. Implement immutable audit logging that admin users cannot delete\n```\n","|\n| **BFLA** | Broken Function Level Authorization (OWASP API5:2023) - regular users can invoke administrative or privileged API functions without proper authorization checks |\n| **Vertical Privilege Escalation** | Accessing functions or data restricted to a higher privilege level, such as regular user accessing admin endpoints |\n| **RBAC** | Role-Based Access Control - authorization model where permissions are assigned to roles and roles are assigned to users |\n| **Function-Level Authorization** | Access control checks that verify whether the authenticated user has permission to invoke a specific API function |\n| **Admin Endpoint** | API endpoints intended only for administrative users, typically managing users, settings, audit logs, and system configuration |\n| **Forced Browsing** | Directly accessing URLs that are not linked in the application but exist on the server, bypassing UI-level access restrictions |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Intercept requests as admin, then replay with regular user token to test function-level authorization\n- **OWASP ZAP**: Forced Browse scanner to discover hidden administrative endpoints and test access control\n- **Autorize (Burp Extension)**: Automated BFLA detection by replaying admin requests with regular user credentials\n- **ffuf**: Endpoint discovery tool: `ffuf -u https:\u002F\u002Fapi.example.com\u002Fapi\u002Fv1\u002FFUZZ -w admin-endpoints.txt -H \"Authorization: Bearer user_token\"`\n- **Nuclei**: Template-based scanner with BFLA detection templates for common frameworks\n\n## Common Scenarios\n\n### Scenario: SaaS Multi-Tenant API BFLA Assessment\n\n**Context**: A SaaS platform has user, moderator, and admin roles. The API serves a React frontend that conditionally renders admin features based on the user's role. The backend API should enforce the same restrictions independently.\n\n**Approach**:\n1. Map admin endpoints from the frontend JavaScript bundle: search for `\u002Fadmin\u002F`, `\u002Fmanage\u002F`, and role-check conditionals\n2. Discover 12 admin endpoints including user management, billing, feature flags, and audit logs\n3. Test each admin endpoint with regular user token:\n   - `GET \u002Fapi\u002Fv1\u002Fadmin\u002Fusers` returns 200 with all user data (BFLA - read)\n   - `PUT \u002Fapi\u002Fv1\u002Fadmin\u002Fusers\u002F1002\u002Frole` accepts role change (BFLA - write)\n   - `DELETE \u002Fapi\u002Fv1\u002Faudit\u002Flogs` returns 200 (BFLA - destructive)\n4. Test method-based bypass: `GET \u002Fapi\u002Fv1\u002Fadmin\u002Fsettings` returns 403, but `PUT \u002Fapi\u002Fv1\u002Fadmin\u002Fsettings` returns 200\n5. Find that the moderator role can access all admin endpoints except `DELETE \u002Fapi\u002Fv1\u002Fadmin\u002Fbilling`\n6. Discover `\u002Fapi\u002Fv2\u002Fadmin\u002Fusers` exists without any authorization (shadow API version)\n\n**Pitfalls**:\n- Only testing GET requests on admin endpoints while missing BFLA in POST\u002FPUT\u002FDELETE methods\n- Not discovering admin endpoints because they are not linked in the UI (requires endpoint enumeration)\n- Assuming RBAC is enforced consistently because one admin endpoint returned 403\n- Missing BFLA in internal\u002Fundocumented API endpoints not listed in the OpenAPI specification\n- Not testing with all available role levels (moderator may have partial admin access)\n\n## Output Format\n\n```\n## Finding: Regular Users Can Access Admin User Management API\n\n**ID**: API-BFLA-001\n**Severity**: Critical (CVSS 9.8)\n**OWASP API**: API5:2023 - Broken Function Level Authorization\n**Affected Endpoints**:\n  - GET \u002Fapi\u002Fv1\u002Fadmin\u002Fusers (read all users)\n  - PUT \u002Fapi\u002Fv1\u002Fadmin\u002Fusers\u002F{id}\u002Frole (change user roles)\n  - DELETE \u002Fapi\u002Fv1\u002Faudit\u002Flogs (delete audit trail)\n  - PUT \u002Fapi\u002Fv1\u002Fadmin\u002Fsettings (modify system config)\n\n**Description**:\nThe API does not enforce function-level authorization on administrative\nendpoints. A regular user can directly call admin API endpoints and\nexecute administrative functions including user management, role changes,\nsystem configuration, and audit log deletion. The frontend hides admin\nfeatures based on role, but the backend API does not enforce the same\nrestrictions.\n\n**Proof of Concept**:\n1. Authenticate as regular user: POST \u002Fapi\u002Fv1\u002Fauth\u002Flogin\n2. Call admin endpoint: GET \u002Fapi\u002Fv1\u002Fadmin\u002Fusers -> 200 OK (returns all 50,000 users)\n3. Elevate own role: PUT \u002Fapi\u002Fv1\u002Fadmin\u002Fusers\u002Fme\u002Frole {\"role\":\"admin\"} -> 200 OK\n4. Delete audit logs: DELETE \u002Fapi\u002Fv1\u002Faudit\u002Flogs -> 204 No Content\n\n**Impact**:\nAny authenticated user can take full administrative control of the\nplatform, access all user data, modify roles, change system configuration,\nand delete audit logs to cover their tracks.\n\n**Remediation**:\n1. Implement RBAC middleware that checks user role before executing any admin function\n2. Apply authorization at the route\u002Fcontroller level, not just the frontend\n3. Use decorator\u002Fannotation-based authorization (e.g., @RequireRole(\"admin\"))\n4. Add automated BFLA tests to the CI\u002FCD pipeline that test every endpoint with every role\n5. Implement immutable audit logging that admin users cannot delete\n```\n",{"name":5,"domain":33,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fwebapp-api-bfla","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":58},[48,51,54],{"tool":49,"command":50},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill webapp-api-bfla",{"tool":52,"command":53},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill webapp-api-bfla",{"tool":55,"command":56},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill webapp-api-bfla","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-api-bfla\u002FSKILL.md",true,[60],{"path":61,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":64,"sourceHtmlUrl":65},"index.json","REFERENCE","参考文档",460,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-api-bfla\u002Findex.json",[67,92,115,137,159,174],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":73,"publishedAt":34},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,33,91],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":34},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[99,74,100,77,101,102,103,33,104,105,106,107,108,109,79,110,111,112,113,114],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":34},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[122,123,124,125,126,127,33,104,128,105,129,130,79,112,131,132,133,134,135,136],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":34},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[75,144,145,146,147,148,149,80,150,33,91,151,152,153,154,155,156,157,158,79],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":34},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[166,167,75,168,146,148,169,80,170,150,33,91,105,30,171,172,173,158,79,81],"thread","processes thread injection detect","injection","memory","process-injection","apc-injection","thread-injection","nt-api",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":34},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[181,75,146,182,169,80,183,184,33,91,185,186,187,188,189,190,79,81,191,192],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]