Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-idnt-01명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | wstg-idnt-01 |
| description | Test Role Definitions |
| category | identity-management |
| owasp_id | WSTG-IDNT-01 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["identity","user-enum","roles","wstg","idnt"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-IDNT-01
Test Role Definitions
Role definitions testing evaluates how well an application implements role-based access control (RBAC). This test identifies whether roles are properly defined, whether users can only access resources appropriate for their role, and whether role hierarchies are correctly enforced. Poorly defined roles can lead to privilege escalation and unauthorized access to sensitive functionality.
| Check | Description |
|---|---|
| Role boundaries | Each role can only access assigned resources |
| Privilege separation | Sensitive functions require specific roles |
| Role escalation | Users cannot self-assign higher roles |
| Cross-role access | Users cannot access other role's data |
# Review application documentation for role definitions
# Common roles to look for:
# - Guest/Anonymous
# - User/Member
# - Moderator
# - Administrator
# - Super Admin
# Check user profile endpoints for role information
curl -s -H "Authorization: Bearer $TOKEN" \
"https://target.com/api/user/profile" | jq '.role'
# Check for role-related parameters
curl -s -H "Authorization: Bearer " \
| jq
#!/bin/bash
# Create accounts for each role and map accessible endpoints
ROLES=("user" "moderator" "admin")
ENDPOINTS=(
"/api/users"
"/api/users/1"
"/api/admin/settings"
"/api/admin/users"
"/api/reports"
"/api/logs"
)
for role in "${ROLES[@]}"; do
echo "=== Testing role: $role ==="
# Use token for this role
TOKEN=$(cat "tokens/${role}_token.txt")
for endpoint in "${ENDPOINTS[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: Bearer $TOKEN" \
"https://target.com${endpoint}")
echo "$endpoint: $status"
done
echo ""
done
# Test if lower-privileged role can access admin functions
# Using regular user token
curl -s -H "Authorization: Bearer $USER_TOKEN" \
"https://target.com/api/admin/users" \
-w "\nStatus: %{http_code}"
# Test if user can modify their own role
curl -s -X PUT \
-H "Authorization: Bearer $USER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"role": "admin"}' \
"https://target.com/api/user/profile"
# Test parameter manipulation
curl -s -X POST \
-H "Authorization: Bearer $USER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"username": "test", "role": "admin"}' \
"https://target.com/api/users"
# User A trying to access User B's resources
curl -s -H "Authorization: Bearer $USER_A_TOKEN" \
"https://target.com/api/users/2/profile"
# User A trying to modify User B's data
curl -s -X PUT \
-H "Authorization: Bearer $USER_A_TOKEN" \
-H "Content-Type: application/json" \
-d '{"email": "attacker@evil.com"}' \
"https://target.com/api/users/2/profile"
# Check if role is enforced on all endpoints
# Sometimes GET is protected but POST is not
# Test different HTTP methods
for method in GET POST PUT DELETE PATCH; do
status=$(curl -s -o /dev/null -w "%{http_code}" \
-X $method \
-H "Authorization: Bearer $USER_TOKEN" \
"https://target.com/api/admin/settings")
echo "$method /api/admin/settings: $status"
done
| Tool | Description | Usage |
|---|---|---|
| Burp Suite Autorize | Access control testing | Automatic re-request with different sessions |
| OWASP ZAP Access Control | Automated role testing | Context-based access testing |
| AuthMatrix | Burp extension | Matrix-based authorization testing |
| Tool | Description |
|---|---|
| Burp Suite | Intercept and modify role parameters |
| Postman | Create collections for different roles |
| curl | Command-line HTTP testing |
// User registration with role injection
{
"username": "attacker",
"password": "password123",
"email": "attacker@test.com",
"role": "admin"
}
// Profile update with role escalation
{
"name": "Attacker",
"role": "administrator",
"isAdmin": true,
"permissions": ["all"]
}
// JWT manipulation (if applicable)
// Original: {"sub":"user123","role":"user"}
// Modified: {"sub":"user123","role":"admin"}
# Burp Autorize configuration
# 1. Install Autorize extension
# 2. Configure low-privileged session cookie
# 3. Enable interception
# 4. Browse as admin
# 5. Review color-coded results:
# - Green: Access denied (correct)
# - Red: Access granted (vulnerability)
# - Yellow: Different response (investigate)
# Python/Flask example
from functools import wraps
from flask import g, abort
def role_required(required_role):
def decorator(f):
@wraps(f)
def decorated_function(*args, **kwargs):
if not g.user:
abort(401)
if g.user.role != required_role and g.user.role != 'admin':
abort(403)
return f(*args, **kwargs)
return decorated_function
return decorator
@app.route('/admin/users')
@role_required('admin')
def admin_users():
return get_all_users()
// Java/Spring Security
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig {
@PreAuthorize("hasRole('ADMIN')")
public void adminOnlyMethod() {
// Only admins can access
}
@PreAuthorize("hasAnyRole('ADMIN', 'MODERATOR')")
public void moderatorMethod() {
// Admins and moderators
}
}
// Node.js/Express middleware
const checkRole = (allowedRoles) => {
return (req, res, next) => {
const userRole = req.user.role
if (!allowedRoles.includes(userRole)) {
return res.status(403).json({
error: "Access denied",
})
}
next()
}
}
// Usage
app.get("/admin/users", authenticate, checkRole(["admin"]), adminController.getUsers)
| Finding | CVSS | Severity |
|---|---|---|
| No role definitions | 8.8 | High |
| Role bypass possible | 8.8 | High |
| Privilege escalation via role manipulation | 8.8 | High |
| Incomplete role enforcement | 6.5 | Medium |
Privilege Escalation Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| CWE ID | Title | Description |
|---|---|---|
| CWE-269 | Improper Privilege Management | Incorrect role handling |
| CWE-284 | Improper Access Control | Missing authorization |
| CWE-285 | Improper Authorization | Authorization bypass |
| CWE-862 | Missing Authorization | No role check |
[ ] Available roles identified
[ ] Role documentation reviewed
[ ] Role permissions mapped
[ ] Vertical privilege escalation tested
[ ] Horizontal access tested
[ ] Role parameter manipulation tested
[ ] All HTTP methods tested
[ ] Role enforcement consistency verified
[ ] Client-side role checks identified
[ ] Server-side enforcement confirmed
[ ] Findings documented
[ ] Remediation recommendations provided