vapt-authz

Authorization & Access Control Testing

When Invoked

The user runs /vapt authz <url> or this skill is triggered as part of Wave 3 during /vapt audit.

Prerequisites

This is the most manual testing category. It requires understanding the application's roles and resources. Check for existing context:

• If VAPT-WAVE2-CONTEXT.md exists -> use discovered endpoints
• If VAPT-AUTH.md exists -> use authentication details and session tokens
• If no context -> discover endpoints and attempt to identify role-based differences

Phase 1: Access Control Mapping

1.1 Identify Roles

Determine the application's role hierarchy:

• Unauthenticated (anonymous)
• Authenticated (regular user)
• Privileged (admin, moderator, manager)
• Super admin / system

1.2 Endpoint Inventory

Build a matrix of endpoints vs roles:

• Which endpoints require authentication?
• Which endpoints are role-restricted?
• Which endpoints handle user-specific data?

# Check endpoint access as unauthenticated
curl -s -o /dev/null -w "%{http_code}" <url>/admin
curl -s -o /dev/null -w "%{http_code}" <url>/api/users
curl -s -o /dev/null -w "%{http_code}" <url>/dashboard

# Check with regular user token
curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer <token>" <url>/admin

Phase 2: Horizontal Privilege Escalation (IDOR)

2.1 Direct Object Reference Testing

For endpoints that reference user-specific data (user IDs, order IDs, file names):

1. Identify the reference pattern (numeric ID, UUID, slug)
2. Access the resource as the authenticated user
3. Modify the reference to another user's resource
4. Check if access is granted

# If user 123 can access their own profile:
curl -s -H "Authorization: Bearer <user_123_token>" <url>/api/users/123

# Try accessing user 124's profile:
curl -s -H "Authorization: Bearer <user_123_token>" <url>/api/users/124

Test across:

• User profiles (/api/users/{id})
• Orders/transactions (/api/orders/{id})
• Documents/files (/api/documents/{id})
• Messages (/api/messages/{id})
• Settings (/api/settings/{user_id})