access-control-testing

사용 방법

설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.

npx skills add https://github.com/mn-youssef/security-skills --skill access-control-testing

시작 전 확인

설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.

원본 Skill 문서

원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.

Access Control Testing (FIND/EXPLOIT — OWASP A01)

Overview

Verify that every object and every action enforces "is this caller allowed?" server-side. Broken access control is the most common and highest-impact real-world flaw — and the easiest to miss because the happy path works perfectly.

Core principle: Authentication proves who you are; authorization proves what you may do. Test the second one on every object and every action — not just the UI-visible ones.

Applies when / Skip when

Applies when: the app has authentication, multiple users, roles, or multi-tenant data —

any resource or action that should be restricted. (Almost every non-trivial app.)

Skip when: the app is fully public/anonymous with no per-user or privileged data → N/A.
If N/A: report "access-control-testing: N/A — no auth/multi-user surface" and stop. Don't

invent access boundaries that don't exist.

⚠️ Authorization

Use test accounts you created on an app you own/are authorized to test. Two accounts (A and B) plus one admin/one low-priv account is the cleanest setup.

The test matrix (run every cell)

	Read	Write/Update	Delete	Admin action
As another user (horizontal)	A reads B's object?	A edits B's?	A deletes B's?	—
As lower privilege (vertical)	user hits admin read?	user hits admin write?	—	user invokes admin fn?
Unauthenticated	no token → data?	no token → mutate?	—	no token → admin?

If any cell succeeds, that's a finding.

Method

Capture a legitimate request as user A (note every id, uuid, slug, filename).
Swap the object reference to B's resource, keep A's session → IDOR/BOLA.
Swap the session (remove token / use lower-priv token) on privileged endpoints → BFLA / vertical.
Force-browse hidden routes (/admin, /api/internal) with a normal account.
Mass assignment — add fields the UI never sends (role, isAdmin, userId, price).
Check every method — GET may be guarded but PUT/DELETE/PATCH forgotten.

See references/access-control-tests.md for concrete request recipes and edge cases.

Quick reference — bug classes

Class	Test
IDOR / BOLA	Change an id/uuid/filename to another user's; do you get their data?
Horizontal privesc	Act on another same-level user's resources.
Vertical privesc	Low-priv account reaches admin function/data.
BFLA	Admin endpoint guarded in UI but callable directly by anyone.
Multi-tenant break	Tenant A reads tenant B (swap `org_id`/`tenant_id`).
Mass assignment	Inject privileged fields into the request body.
Forced browsing	Guess/enumerate unlinked privileged routes.

Output

Findings in the register: which account hit which endpoint/object, the exact swapped request, what was exposed, and horizontal vs vertical. Severity is almost always High+.

Hand-off

Confirmed on a running app → reproduce via `active-pentest`; chain with others in `vulnerability-chaining`; fix via `security-hardening` (deny-by-default, server-side checks).

Common mistakes

Testing only as admin — you'll never see the bug. Always test as the lower privilege.
Trusting that a hidden/unlinked endpoint is safe — enumerate and call it directly.
Checking GET only — mutations are where damage happens.
Assuming UUIDs are safe — they leak (in responses, logs, referrers) and are still IDOR-able.
Forgetting predictable patterns: sequential ids, base64'd ids, guessable filenames.