skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

exploiting-broken-function-level-authorization

Tests APIs for Broken Function Level Authorization by probing admin endpoints with low-privilege credentials.

4|Updated Apr 28, 2026
Search Tags:#authorization#owasp#access control#penetration testing#privilege escalation#api security#bfla
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill exploiting-broken-function-level-authorization-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-broken-function-level-authorization
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/exploiting-broken-function-level-authorization
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill exploiting-broken-function-level-authorization-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve? APIs often hide administrative features in the frontend while failing to enforce authorization on backend endpoints, letting regular users invoke privileged functions. This Skill systematically detects those Broken Function Level Authorization (BFLA) flaws, mapped to OWASP API5:2023, during authorized security assessments. ## Core Features & Use Cases - Admin Endpoint Discovery: Enumerates common administrative paths (/admin, /api/v1/admin/users, /internal) and tests them with regular user tokens across multiple HTTP methods. - Role Matrix Testing: Compares access across unauthenticated, user, moderator, and admin roles to find vertical privilege escalation gaps. - Bypass Techniques: Tests HTTP method switching, parameter-based role injection (role=admin, is_admin), API version bypasses, and path manipulation (case variation, URL encoding, traversal). - Use Case: During an authorized SaaS platform assessment, run the included agent script with a low-privilege token against the target API to produce a JSON report of accessible admin endpoints, then document findings using the provided severity-rated output template. ## Quick Start Run the BFLA testing agent against my authorized target API at https://api.example.com using my regular user token and generate a JSON findings report.

Frequently Asked Questions about exploiting-broken-function-level-authorization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test APIs for Broken Function Level Authorization?▼

Authenticate as a low-privilege user and directly request administrative endpoints like /api/v1/admin/users, checking for responses other than 401 or 403. The included agent.py script automates this by probing common admin paths with a bearer token and reporting accessible endpoints.

What tools detect BFLA vulnerabilities in REST APIs?▼

Burp Suite with the Autorize extension replays admin requests using low-privilege tokens to flag authorization bypasses. This Skill also uses a Python requests-based script, ffuf for endpoint discovery, and Nuclei templates for common framework checks.

Can HTTP method switching bypass API authorization checks?▼

Yes, some APIs enforce authorization only on specific methods, so a GET may return 403 while PUT or DELETE succeeds. The Skill tests GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, and TRACE against each admin endpoint to find these gaps.

Does this BFLA testing require authorization to run?▼

Yes, written authorization specifying the target API and in-scope administrative functions is a mandatory prerequisite. Testing without permission is unauthorized access; the Skill is designed for sanctioned assessments with test accounts at multiple privilege levels.

Why does BFLA testing miss some admin endpoints?▼

Admin endpoints are often unlinked in the UI and absent from OpenAPI specs, so discovery requires enumerating JavaScript bundles, guessing path conventions, and checking older API versions. Testing only GET requests also misses BFLA in POST, PUT, and DELETE methods.

Related Skills

Explore More Software Engineering Skills→
yaklangyaklang
1.6k

api-recon-and-docs

Enumerate API endpoints, schemas, versions, and hidden documentation from OpenAPI/Swagger artifacts.

Official
Intermediate
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
securityfortechsecurityfortech
6

bola-idor

Fuzz object identifiers in URLs, bodies, and headers to detect BOLA and IDOR vulnerabilities.

Official
Advanced
jcastillotxjcastillotx

Burp Suite Web Application Testing

Intercept and analyze HTTP traffic with Burp Suite proxy tools.

Community
Advanced