Authorization Testing Skill

Purpose

Validate authorization failures by attempting actions that should be blocked based on:

• User identity (horizontal privilege escalation / IDOR)
• User role/privilege level (vertical privilege escalation)
• Resource ownership rules
• Function-level access controls

Vulnerability Types Covered

1. Insecure Direct Object Reference - IDOR (CWE-639)

Access other users' resources by manipulating object IDs.

Test Pattern: Authenticate as User A, access User B's resource (change ID in URL/params)
Expected: 403 Forbidden | Actual if vulnerable: 200 OK
Example: /api/user/456 accessed by user 123