What problem does it solve? Web applications often fail to enforce proper access controls, letting attackers read other users' data (IDOR), escalate to admin functions, or skip payment steps. This Skill gives an AI agent a systematic, tool-driven methodology to detect these authorization flaws before real attackers do. ## Core Features & Use Cases - Horizontal Privilege Escalation (IDOR) Testing: Replaces resource IDs in URL paths, query strings, and request bodies, handles encoded IDs (Base64, UUID, hash), and supports bulk ID enumeration to measure data exposure scope. - Vertical Privilege Escalation Testing: Probes admin endpoints with low-privilege credentials, tampers with role parameters (role, is_admin, group), manipulates hidden form fields, and forges headers like X-Original-URL and X-Forwarded-For. - Business Logic Bypass Testing: Detects workflow skipping, price/quantity tampering, coupon reuse, race conditions, and API version downgrade bypasses. - Use Case: Given a target web app and two test accounts, the agent crawls endpoints, replays requests across sessions with do_http_request and send_http_request_packet, confirms each vulnerable instance, and immediately reports every finding via the cybersecurity-risk tool. ## Quick Start Test this web application for horizontal and vertical authorization bypass vulnerabilities using two provided test accounts and report every confirmed finding.
