testing-for-broken-access-control

Build an access control matrix of endpoints versus roles, then replay requests using tokens from lower-privilege accounts against higher-privilege endpoints. This Skill's Python agent automates vertical escalation, horizontal IDOR, and unauthenticated access checks, flagging any endpoint returning 200 where 403 is expected.

Send authenticated requests to resource URLs containing other users' IDs, such as /api/users/{id}/profile, and check for 200 responses with substantial body content. The agent's horizontal escalation test iterates resource templates across a list of user IDs and reports matches as IDOR findings.

Burp Suite Professional with the Authorize extension automates role-based request comparison, while ffuf discovers hidden endpoints lacking access controls. This Skill adds a Python requests-based agent for scripted vertical, horizontal, and mass-assignment testing with JSON reporting.

No. Testing requires explicit written authorization for the target, as stated in the Skill's prerequisites. It is designed for authorized penetration tests, lab environments, and sanctioned security audits only.

A 200 status does not always mean a vulnerability; some endpoints legitimately return public data or empty responses. Verify findings by comparing response bodies across roles and confirming the returned data actually belongs to another user or tenant.

Mass assignment occurs when an update endpoint accepts privilege fields like role, is_admin, or permissions in the request body. The agent submits these fields via PUT to the profile endpoint and flags the application if the injected values are reflected and accepted.