authz-bypass

What problem does it solve?

This Skill addresses critical security vulnerabilities where users can access or manipulate data and functionality they are not authorized to, leading to data breaches and unauthorized actions.

Core Features & Use Cases

• IDOR Testing: Identifies Insecure Direct Object References by manipulating parameters like invoice=, user=, etc.
• Horizontal & Vertical Bypass: Tests if users can access other users' data or perform administrative actions with lower privileges.
• Header Injection: Exploits special headers like X-Original-URL and X-Forwarded-For to bypass access controls.
• Use Case: A tester uses this skill to discover that by changing a URL parameter from order=123 to order=124 while logged in as a regular user, they can view another customer's order details.

Quick Start

Test for authorization bypass by swapping session IDs and manipulating URL parameters.