skills.rest
Fatt1
Fatt1COMMUNITY
Explore all skills by this author →
GitHub

create-vuln-grades

Generate a Laravel module with an IDOR vulnerability for student grades.

Updated Mar 5, 2026
Search Tags:#security#vulnerability#owasp#scaffolding#laravel#idor
One-click install
npx skills add https://github.com/Fatt1/ANMMT --skill create-vuln-grades
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: create-vuln-grades
Source: https://github.com/Fatt1/ANMMT/tree/main/.github/skills/create-vuln-grades
Command: npx skills add https://github.com/Fatt1/ANMMT --skill create-vuln-grades

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates the creation of an intentionally vulnerable "View Grades" module in a Laravel application, specifically designed to demonstrate Insecure Direct Object Reference (IDOR) vulnerabilities for security training.

Core Features & Use Cases

  • Scaffolds Vulnerable Code: Generates a Laravel Grade model, migration, controller, route, and blade view.
  • Demonstrates IDOR: The generated controller uses Grade::find($id) without proper authorization checks, allowing any authenticated user to view any student's grades.
  • Use Case: Use this Skill when instructed to set up the grades viewing functionality for a Capture The Flag (CTF) security lab, focusing on demonstrating broken access control.

Quick Start

Use the create-vuln-grades skill to scaffold the grades controller, grades route, and grades view.

Frequently Asked Questions about create-vuln-grades

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create an IDOR vulnerability in a Laravel application for a security lab?▼

To create an IDOR vulnerability in Laravel, you can scaffold a controller using `Grade::find($id)` without ownership checks. This allows any authenticated user to view other students' grades by changing the URL ID parameter.

What is Insecure Direct Object Reference (IDOR) in Laravel routes?▼

IDOR in Laravel routes occurs when a controller fetches a model directly by its ID without verifying the authenticated user's ownership. It allows attackers to access unauthorized data by manipulating route parameters.

How do I scaffold a vulnerable grades module for an OWASP CTF challenge?▼

You can scaffold a vulnerable grades module to generate a Laravel migration, model, controller, and Tailwind CSS blade view. The generated code intentionally marks the broken access control line for CTF training.

Does this scaffolding tool generate front-end views with Tailwind CSS?▼

Yes, this scaffolding tool generates a Tailwind CSS blade view for displaying student grades. It creates the complete module alongside the vulnerable controller and migration.

Can I use this to demonstrate OWASP A01:2021 Broken Access Control?▼

Yes, you can use this to demonstrate OWASP A01:2021 Broken Access Control. It specifically generates a Laravel grades module lacking authorization checks, directly targeting the IDOR vulnerability class.

Related Skills

Explore More Software Engineering Skills→
Fatt1Fatt1

create-vuln-login

Generate a Laravel 11 login module with SQL injection vulnerability.

Community
Intermediate
SivanwolSivanwol

laravel-policies

Define Laravel authorization policies with standard and custom action methods.

Community
Advanced
allsmogallsmog
22

Vulnerability Patterns

Identify web vulnerability patterns and exploitation flows for whitebox penetration testing.

Community
Intermediate
sasabajicsasabajic
1

laravel-security

Enforce Laravel security best practices for validation, authorization, and data handling.

Community
Advanced