What problem does it solve? Static scanners flag broken access control candidates (BFLA/IDOR) but cannot prove exploitability, producing false positives. This Skill dynamically fires real requests against a running staging or local target to confirm or refute each candidate using HTTP status codes. ## Core Features & Use Cases - BFLA verification: Calls admin APIs (e.g., /adm/v1/users) with a normal user token and compares against anonymous access to detect missing role checks. - IDOR verification with false-positive refutation: Accesses user A's resource with user B's token; an HTTP 403 response immediately confirms the static finding was a false positive. - Fail-closed safety gate: Enforces scope_guard validation before any request, blocking production or public targets at the code level, with GET-only non-destructive testing by default. - Use Case: After a static scan flags @PathVariable id endpoints as IDOR candidates, run this Skill against localhost with two test accounts to dynamically prove which endpoints actually leak other users' data. ## Quick Start Run the access-control penetration test against my local staging app at http://localhost:7171 using the static scan results and my two test accounts to confirm which BFLA and IDOR candidates are actually exploitable.
