| name | broken-function-level-authorization |
| description | BFLA testing for action-level authorization failures across endpoints, admin functions, and API operations |
Broken Function Level Authorization
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Deep Exploitation Guide
Broken Function Level Authorization (BFLA)
BFLA is action-level authorization failure: callers invoke functions (endpoints, mutations, admin tools) they are not entitled to. It appears when enforcement differs across transports, gateways, roles, or when services trust client hints. Bind subject × action at the service that performs the action.
Attack Surface
- Vertical authz: privileged/admin/staff-only actions reachable by basic users
- Feature gates: toggles enforced at edge/UI, not at core services
- Transport drift: REST vs GraphQL vs gRPC vs WebSocket with inconsistent checks
- Gateway trust: backends trust X-User-Id/X-Role injected by proxies/edges
- Background workers/jobs performing actions without re-checking authz
High-Value Actions
- Role/permission changes, impersonation/sudo, invite/accept into orgs
- Approve/void/refund/credit issuance, price/plan overrides
- Export/report generation, data deletion, account suspension/reactivation
- Feature flag toggles, quota/grant adjustments, license/seat changes
- Security settings: 2FA reset, email/phone verification overrides
Reconnaissance
Surface Enumeration
- Admin/staff consoles and APIs, support tools, internal-only endpoints exposed via gateway
- Hidden buttons and disabled UI paths (feature-flagged) mapped to still-live endpoints
- GraphQL schemas: mutations and admin-only fields/types; gRPC service descriptors (reflection)
- Mobile clients often reveal extra endpoints/roles in app bundles or network logs
Signals
- 401/403 on UI but 200 via direct API call; differing status codes across transports
- Actions succeed via background jobs when direct call is denied
- Changing only headers (role/org) alters access without token change
Key Vulnerabilities
Verb Drift and Aliases
- Alternate methods: GET performing state change; POST vs PUT vs PATCH differences; X-HTTP-Method-Override/_method
- Alternate endpoints performing the same action with weaker checks (legacy vs v2, mobile vs web)
Edge vs Core Mismatch
- Edge blocks an action but core service RPC accepts it directly; call internal service via exposed API route or SSRF
- Gateway-injected identity headers override token claims; supply conflicting headers to test precedence
Feature Flag Bypass
- Client-checked feature gates; call backend endpoints directly
- Admin-only mutations exposed but hidden in UI; invoke via GraphQL or gRPC tools
Batch Job Paths
- Create export/import jobs where creation is allowed but finalize/approve lacks authz; finalize others' jobs
- Replay webhooks/background tasks endpoints that perform privileged actions without verifying caller
Content-Type Paths
- JSON vs form vs multipart handlers using different middleware: send the action via the most permissive parser
Advanced Techniques
GraphQL
- Resolver-level checks per mutation/field; do not assume top-level auth covers nested mutations or admin fields
- Abuse aliases/batching to sneak privileged fields; persisted queries sometimes bypass auth transforms
mutation Promote($id:ID!){
a: updateUser(id:$id, role: ADMIN){ id role }
}
gRPC
- Method-level auth via interceptors must enforce audience/roles; probe direct gRPC with tokens of lower role
- Reflection lists services/methods; call admin methods that the gateway hid
WebSocket
- Handshake-only auth: ensure per-message authorization on privileged events (e.g., admin:impersonate)
- Try emitting privileged actions after joining standard channels
Multi-Tenant
- Actions requiring tenant admin enforced only by header/subdomain; attempt cross-tenant admin actions by switching selectors with same token
Microservices
- Internal RPCs trust upstream checks; reach them through exposed endpoints or SSRF; verify each service re-enforces authz
Bypass Techniques
Header Trust
- Supply X-User-Id/X-Role/X-Organization headers; remove or contradict token claims; observe which source wins
Route Shadowing
- Legacy/alternate routes (e.g., /admin/v1 vs /v2/admin) that skip new middleware chains
Idempotency and Retries
- Retry or replay finalize/approve endpoints that apply state without checking actor on each call
Cache Key Confusion
- Cached authorization decisions at edge leading to cross-user reuse; test with Vary and session swaps
Testing Methodology
- Build Actor × Action matrix - Unauth, basic, premium, staff/admin; enumerate actions per role
- Obtain tokens/sessions - For each role
- Exercise every action - Across all transports and encodings (JSON, form, multipart), including method overrides
- Vary headers and selectors - Org/tenant/project; test behind gateway vs direct-to-service
- Include background flows - Job creation/finalization, webhooks, queues; confirm re-validation
Validation
- Show a lower-privileged principal successfully invokes a restricted action (same inputs) while the proper role succeeds and another lower role fails
- Provide evidence across at least two transports or encodings demonstrating inconsistent enforcement
- Demonstrate that removing/altering client-side gates (buttons/flags) does not affect backend success
- Include durable state change proof: before/after snapshots, audit logs, and authoritative sources
False Positives
- Read-only endpoints mislabeled as admin but publicly documented
- Feature toggles intentionally open to all roles for preview/beta with clear policy
- Simulated environments where admin endpoints are stubbed with no side effects
Impact
- Privilege escalation to admin/staff actions
- Monetary/state impact: refunds/credits/approvals without authorization
- Tenant-wide configuration changes, impersonation, or data deletion
- Compliance and audit violations due to bypassed approval workflows
Pro Tips
- Start from the role matrix; test every action with basic vs admin tokens across REST/GraphQL/gRPC
- Diff middleware stacks between routes; weak chains often exist on legacy or alternate encodings
- Inspect gateways for identity header injection; never trust client-provided identity
- Treat jobs/webhooks as first-class: finalize/approve must re-check the actor
- Prefer minimal PoCs: one request that flips a privileged field or invokes an admin method with a basic token
Summary
Authorization must bind the actor to the specific action at the service boundary on every request and message. UI gates, gateways, or prior steps do not substitute for function-level checks.
Platform Methodology
Broken Function Level Authorization
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Deep Exploitation Guide
Broken Function Level Authorization (BFLA)
BFLA is action-level authorization failure: callers invoke functions (endpoints, mutations, admin tools) they are not entitled to. It appears when enforcement differs across transports, gateways, roles, or when services trust client hints. Bind subject × action at the service that performs the action.
Attack Surface
- Vertical authz: privileged/admin/staff-only actions reachable by basic users
- Feature gates: toggles enforced at edge/UI, not at core services
- Transport drift: REST vs GraphQL vs gRPC vs WebSocket with inconsistent checks
- Gateway trust: backends trust X-User-Id/X-Role injected by proxies/edges
- Background workers/jobs performing actions without re-checking authz
High-Value Actions
- Role/permission changes, impersonation/sudo, invite/accept into orgs
- Approve/void/refund/credit issuance, price/plan overrides
- Export/report generation, data deletion, account suspension/reactivation
- Feature flag toggles, quota/grant adjustments, license/seat changes
- Security settings: 2FA reset, email/phone verification overrides
Reconnaissance
Surface Enumeration
- Admin/staff consoles and APIs, support tools, internal-only endpoints exposed via gateway
- Hidden buttons and disabled UI paths (feature-flagged) mapped to still-live endpoints
- GraphQL schemas: mutations and admin-only fields/types; gRPC service descriptors (reflection)
- Mobile clients often reveal extra endpoints/roles in app bundles or network logs
Signals
- 401/403 on UI but 200 via direct API call; differing status codes across transports
- Actions succeed via background jobs when direct call is denied
- Changing only headers (role/org) alters access without token change
Key Vulnerabilities
Verb Drift and Aliases
- Alternate methods: GET performing state change; POST vs PUT vs PATCH differences; X-HTTP-Method-Override/_method
- Alternate endpoints performing the same action with weaker checks (legacy vs v2, mobile vs web)
Edge vs Core Mismatch
- Edge blocks an action but core service RPC accepts it directly; call internal service via exposed API route or SSRF
- Gateway-injected identity headers override token claims; supply conflicting headers to test precedence
Feature Flag Bypass
- Client-checked feature gates; call backend endpoints directly
- Admin-only mutations exposed but hidden in UI; invoke via GraphQL or gRPC tools
Batch Job Paths
- Create export/import jobs where creation is allowed but finalize/approve lacks authz; finalize others' jobs
- Replay webhooks/background tasks endpoints that perform privileged actions without verifying caller
Content-Type Paths
- JSON vs form vs multipart handlers using different middleware: send the action via the most permissive parser
Advanced Techniques
GraphQL
- Resolver-level checks per mutation/field; do not assume top-level auth covers nested mutations or admin fields
- Abuse aliases/batching to sneak privileged fields; persisted queries sometimes bypass auth transforms
mutation Promote($id:ID!){
a: updateUser(id:$id, role: ADMIN){ id role }
}
gRPC
- Method-level auth via interceptors must enforce audience/roles; probe direct gRPC with tokens of lower role
- Reflection lists services/methods; call admin methods that the gateway hid
WebSocket
- Handshake-only auth: ensure per-message authorization on privileged events (e.g., admin:impersonate)
- Try emitting privileged actions after joining standard channels
Multi-Tenant
- Actions requiring tenant admin enforced only by header/subdomain; attempt cross-tenant admin actions by switching selectors with same token
Microservices
- Internal RPCs trust upstream checks; reach them through exposed endpoints or SSRF; verify each service re-enforces authz
Bypass Techniques
Header Trust
- Supply X-User-Id/X-Role/X-Organization headers; remove or contradict token claims; observe which source wins
Route Shadowing
- Legacy/alternate routes (e.g., /admin/v1 vs /v2/admin) that skip new middleware chains
Idempotency and Retries
- Retry or replay finalize/approve endpoints that apply state without checking actor on each call
Cache Key Confusion
- Cached authorization decisions at edge leading to cross-user reuse; test with Vary and session swaps
Testing Methodology
- Build Actor × Action matrix - Unauth, basic, premium, staff/admin; enumerate actions per role
- Obtain tokens/sessions - For each role
- Exercise every action - Across all transports and encodings (JSON, form, multipart), including method overrides
- Vary headers and selectors - Org/tenant/project; test behind gateway vs direct-to-service
- Include background flows - Job creation/finalization, webhooks, queues; confirm re-validation
Validation
- Show a lower-privileged principal successfully invokes a restricted action (same inputs) while the proper role succeeds and another lower role fails
- Provide evidence across at least two transports or encodings demonstrating inconsistent enforcement
- Demonstrate that removing/altering client-side gates (buttons/flags) does not affect backend success
- Include durable state change proof: before/after snapshots, audit logs, and authoritative sources
False Positives
- Read-only endpoints mislabeled as admin but publicly documented
- Feature toggles intentionally open to all roles for preview/beta with clear policy
- Simulated environments where admin endpoints are stubbed with no side effects
Impact
- Privilege escalation to admin/staff actions
- Monetary/state impact: refunds/credits/approvals without authorization
- Tenant-wide configuration changes, impersonation, or data deletion
- Compliance and audit violations due to bypassed approval workflows
Pro Tips
- Start from the role matrix; test every action with basic vs admin tokens across REST/GraphQL/gRPC
- Diff middleware stacks between routes; weak chains often exist on legacy or alternate encodings
- Inspect gateways for identity header injection; never trust client-provided identity
- Treat jobs/webhooks as first-class: finalize/approve must re-check the actor
- Prefer minimal PoCs: one request that flips a privileged field or invokes an admin method with a basic token
Summary
Authorization must bind the actor to the specific action at the service boundary on every request and message. UI gates, gateways, or prior steps do not substitute for function-level checks.
Validation & Reporting
- Confirm every finding with reproducible PoC before reporting
- Document: severity (CVSS), affected asset, steps, evidence, remediation
- Use
record_vulnerability when running inside the penkit51 platform
- Chain low-severity findings into higher-impact attack paths
- Never report without evidence — distinguish hypothesis from confirmed vuln
Validation & Reporting
- Confirm every finding with reproducible PoC before reporting
- Document: severity (CVSS), affected asset, steps, evidence, remediation
- Use
record_vulnerability when running inside the penkit51 platform
- Chain low-severity findings into higher-impact attack paths
- Never report without evidence — distinguish hypothesis from confirmed vuln
