[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AGAMF5YXN0QGBC6QZMCN9R":3,"skill-same:01M6AGAMF5YXN0QGBC6QZMCN9R":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AGAMF5YXN0QGBC6QZMCN9R","testing-for-broken-access-control",null,"Systematically tests web applications and APIs for broken access control (OWASP A01:2021), including privilege escalation, missing function-level checks, insecure direct object references, and multi-tenant data leakage, using Burp Suite with the Authorize extension. Use during authorized penetration tests or RBAC\u002Fmulti-tenant authorization audits.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36146,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-broken-access-control\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"testing for broken access control","testing","escalation","application-security","applications","t1505","web-security","t1059","web-application-security","authorization","owasp","access-control","data","penetration-testing","privilege-escalation","pr","rbac","web","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: testing-for-broken-access-control\ndescription: Systematically tests web applications and APIs for broken access control\n  (OWASP A01:2021), including privilege escalation, missing function-level checks, insecure\n  direct object references, and multi-tenant data leakage, using Burp Suite with the\n  Authorize extension. Use during authorized penetration tests or RBAC\u002Fmulti-tenant\n  authorization audits.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- access-control\n- authorization\n- owasp\n- privilege-escalation\n- web-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1068\n---\n\n# Testing for Broken Access Control\n\n## When to Use\n\n- During authorized penetration tests as the primary assessment for OWASP A01:2021 - Broken Access Control\n- When evaluating role-based access control (RBAC) implementations across all application endpoints\n- For testing multi-tenant applications where users in one organization should not access another's data\n- When assessing API endpoints for missing or inconsistent authorization checks\n- During security audits where privilege escalation and unauthorized access are primary concerns\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: With Authorize extension for automated access control testing\n- **Multiple test accounts**: Accounts at each role level (admin, manager, user, guest)\n- **Application role matrix**: Documentation of what each role should and should not access\n- **curl\u002Fhttpie**: For manual endpoint testing with different authentication contexts\n- **ffuf**: For discovering hidden endpoints that may lack access controls\n\n## Workflow\n\n### Step 1: Map All Endpoints and Create Access Control Matrix\n\nDocument every endpoint and the expected access level for each role.\n\n```bash\n# Extract all endpoints from Burp Site Map\n# Target > Site Map > Right-click > Copy URLs in this host\n\n# Build a matrix of endpoints vs roles:\n# | Endpoint              | Admin | Manager | User | Guest |\n# |-----------------------|-------|---------|------|-------|\n# | GET \u002Fadmin\u002Fdashboard  | Allow | Deny    | Deny | Deny  |\n# | GET \u002Fapi\u002Fusers        | Allow | Allow   | Deny | Deny  |\n# | PUT \u002Fapi\u002Fusers\u002F{id}   | Allow | Deny    | Own  | Deny  |\n# | DELETE \u002Fapi\u002Fposts\u002F{id} | Allow | Allow   | Own  | Deny  |\n\n# Discover hidden endpoints\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-directories.txt \\\n  -mc 200,301,302,403 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -o endpoints.json -of json\n\n# API endpoint discovery\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fv1\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,302,401,403,405 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\"\n```\n\n### Step 2: Configure Automated Access Control Testing\n\nSet up Burp Authorize extension for parallel role-based testing.\n\n```\n# Install Authorize extension:\n# Burp > Extender > BApp Store > Search \"Authorize\" > Install\n\n# Configuration for three-tier testing:\n# 1. Browse the application as Admin (capture all requests)\n# 2. In Authorize tab:\n#    a. Add Regular User's session token in \"Replace cookies\u002Fheaders\"\n#    b. Optionally add a second row for Unauthenticated (no auth header)\n\n# Example header replacement setup:\n# Row 1 (Low-privilege user):\n#   Cookie: session=low_priv_user_session\n#   Authorization: Bearer low_priv_token\n#\n# Row 2 (Unauthenticated):\n#   [Empty - removes all auth headers]\n\n# Enable interception in Authorize:\n# - Check \"Intercept requests from Proxy\"\n# - Check \"Intercept requests from Repeater\"\n\n# Authorize shows results as:\n# Green  = Properly restricted (different response for different user)\n# Red    = POTENTIALLY VULNERABLE (same response regardless of role)\n# Orange = Uncertain (needs manual verification)\n```\n\n### Step 3: Test Vertical Privilege Escalation\n\nAttempt to access higher-privilege functionality with lower-privilege accounts.\n\n```bash\n# Collect tokens for each role\nADMIN_TOKEN=\"Bearer admin_jwt_here\"\nMANAGER_TOKEN=\"Bearer manager_jwt_here\"\nUSER_TOKEN=\"Bearer user_jwt_here\"\n\n# Test admin endpoints with user token\nADMIN_ENDPOINTS=(\n  \"GET \u002Fadmin\u002Fdashboard\"\n  \"GET \u002Fadmin\u002Fusers\"\n  \"POST \u002Fadmin\u002Fusers\u002Fcreate\"\n  \"PUT \u002Fadmin\u002Fsettings\"\n  \"DELETE \u002Fadmin\u002Fusers\u002F5\"\n  \"GET \u002Fadmin\u002Flogs\"\n  \"GET \u002Fadmin\u002Freports\u002Fexport\"\n  \"POST \u002Fadmin\u002Fbackup\"\n)\n\nfor entry in \"${ADMIN_ENDPOINTS[@]}\"; do\n  method=$(echo \"$entry\" | cut -d' ' -f1)\n  endpoint=$(echo \"$entry\" | cut -d' ' -f2)\n  echo -n \"$method $endpoint (as user): \"\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\")\n  if [ \"$status\" == \"200\" ] || [ \"$status\" == \"201\" ]; then\n    echo \"VULNERABLE ($status)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test with method override headers\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -X POST \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"X-HTTP-Method-Override: DELETE\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\u002F5\"\n\n# Test with different HTTP methods\nfor method in GET POST PUT PATCH DELETE OPTIONS HEAD; do\n  echo -n \"$method \u002Fadmin\u002Fusers: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\"\n  echo\ndone\n```\n\n### Step 4: Test Horizontal Privilege Escalation\n\nVerify that users cannot access resources belonging to other users at the same privilege level.\n\n```bash\n# User A (ID: 101) testing access to User B's (ID: 102) resources\nUSER_A_TOKEN=\"Bearer user_a_jwt\"\n\nRESOURCES=(\n  \"\u002Fapi\u002Fusers\u002F102\u002Fprofile\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Forders\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fmessages\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fdocuments\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fsettings\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fpayment-methods\"\n)\n\nfor resource in \"${RESOURCES[@]}\"; do\n  echo -n \"GET $resource: \"\n  response=$(curl -s -w \"\\n%{http_code}\" \\\n    -H \"Authorization: $USER_A_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com$resource\")\n  status=$(echo \"$response\" | tail -1)\n  body_len=$(echo \"$response\" | head -n -1 | wc -c)\n  if [ \"$status\" == \"200\" ] && [ \"$body_len\" -gt 50 ]; then\n    echo \"VULNERABLE ($status, $body_len bytes)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test write operations across users\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\":\"Hacked\",\"email\":\"hacked@evil.com\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fprofile\" -w \"%{http_code}\"\n\n# Test delete operations\ncurl -s -X DELETE \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fdocuments\u002F1\" -w \"%{http_code}\"\n```\n\n### Step 5: Test Function-Level Access Control\n\nVerify that specific functions enforce authorization properly.\n\n```bash\n# Test unauthenticated access to protected endpoints\nPROTECTED_ENDPOINTS=(\n  \"\u002Fapi\u002Fuser\u002Fprofile\"\n  \"\u002Fapi\u002Ftransactions\"\n  \"\u002Fapi\u002Fsettings\"\n  \"\u002Fadmin\u002Fdashboard\"\n  \"\u002Fapi\u002Fexport\u002Fusers\"\n)\n\nfor endpoint in \"${PROTECTED_ENDPOINTS[@]}\"; do\n  echo -n \"No auth: GET $endpoint: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\"\n  echo\ndone\n\n# Test with expired\u002Finvalid tokens\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -H \"Authorization: Bearer invalid_token_here\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Test role manipulation in JWT claims\n# If JWT contains role claim, try modifying it\n# (requires JWT vulnerability - see JWT testing skill)\n\n# Test parameter-based role escalation\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"role\":\"admin\",\"is_admin\":true,\"permissions\":[\"admin\",\"superuser\"]}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F101\u002Fprofile\"\n\n# Test registration with elevated role\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"new@test.com\",\"password\":\"Test123!\",\"role\":\"admin\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fauth\u002Fregister\"\n```\n\n### Step 6: Test Multi-Tenant Isolation\n\nVerify that tenant boundaries are enforced in multi-tenant applications.\n\n```bash\n# User in Tenant A testing access to Tenant B's resources\nTENANT_A_TOKEN=\"Bearer tenant_a_user_jwt\"\n\n# Direct tenant resource access\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fusers\" | jq .\n\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fsettings\" | jq .\n\n# Test tenant switching via header\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"X-Tenant-ID: tenant-b-id\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq .\n\n# Test tenant ID in request body\ncurl -s -X POST \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"tenant_id\":\"tenant-b-id\",\"query\":\"SELECT * FROM users\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Freports\u002Fcustom\"\n\n# Enumerate tenant IDs\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002FFUZZ\" \\\n  -w \u003C(seq 1 100) \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -mc 200 -t 10 -rate 20\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Vertical Privilege Escalation** | Lower-privilege user accessing higher-privilege functionality (user -> admin) |\n| **Horizontal Privilege Escalation** | User accessing another user's resources at the same privilege level |\n| **Function-Level Access Control** | Authorization checks on specific features\u002Ffunctions regardless of URL |\n| **RBAC** | Role-Based Access Control - permissions assigned to roles, roles assigned to users |\n| **ABAC** | Attribute-Based Access Control - permissions based on user\u002Fresource\u002Fenvironment attributes |\n| **Multi-Tenant Isolation** | Ensuring data and functionality separation between different organizations\u002Ftenants |\n| **Insecure Direct Object Reference** | Accessing objects by manipulating identifiers without authorization checks |\n| **Missing Function-Level Check** | Endpoint exists but does not verify the caller has permission to invoke it |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Request interception and role-based testing |\n| **Authorize (Burp Extension)** | Automated access control testing across sessions |\n| **AutoRepeater (Burp Extension)** | Automatically replays requests with different auth contexts |\n| **Postman** | API testing with environment switching between roles |\n| **ffuf** | Discovering hidden endpoints that may lack access controls |\n| **OWASP ZAP** | Access control testing with context-aware scanning |\n\n## Common Scenarios\n\n### Scenario 1: Admin Panel Without Auth Check\nThe `\u002Fadmin\u002Fdashboard` endpoint returns the admin panel when accessed with a regular user's session token. The front-end hides the admin menu, but the back-end does not enforce role checks.\n\n### Scenario 2: API Endpoint Missing Authorization\nThe `DELETE \u002Fapi\u002Fusers\u002F{id}` endpoint checks for authentication (valid token) but not authorization (admin role). Any authenticated user can delete any other user's account.\n\n### Scenario 3: Tenant Data Leakage\nA SaaS application uses `tenant_id` in API request headers. Changing the `X-Tenant-ID` header to another tenant's ID returns their data, bypassing tenant isolation.\n\n### Scenario 4: Mass Assignment Role Escalation\nThe user profile update endpoint at `PUT \u002Fapi\u002Fusers\u002F{id}` accepts a `role` field in the JSON body. Submitting `\"role\":\"admin\"` alongside a profile update elevates the user to administrator.\n\n## Output Format\n\n```\n## Broken Access Control Assessment Report\n\n**Target**: target.example.com\n**Assessment Date**: 2024-01-15\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### Access Control Matrix Results\n| Endpoint | Admin | Manager | User | Guest | Expected | Actual |\n|----------|-------|---------|------|-------|----------|--------|\n| GET \u002Fadmin\u002Fdashboard | 200 | 200 | 200 | 302 | Admin only | FAIL |\n| DELETE \u002Fapi\u002Fusers\u002F{id} | 200 | 200 | 200 | 401 | Admin only | FAIL |\n| GET \u002Fapi\u002Fusers\u002Fother\u002Fprofile | 200 | 200 | 200 | 401 | Own only | FAIL |\n| PUT \u002Fapi\u002Fusers\u002Fother\u002Fsettings | 200 | 200 | 200 | 401 | Own only | FAIL |\n| GET \u002Fapi\u002Forg\u002Fother-tenant | 200 | 200 | 200 | 401 | Same tenant | FAIL |\n\n### Critical Findings\n1. **Vertical Escalation**: Regular users can access \u002Fadmin\u002F* endpoints\n2. **Horizontal IDOR**: Users can read\u002Fmodify other users' profiles\n3. **Tenant Isolation**: Cross-tenant data access via header manipulation\n4. **Mass Assignment**: Role escalation via profile update endpoint\n\n### Impact\n- Complete administrative access for any authenticated user\n- Full user data access across all accounts (15,000+ users)\n- Cross-tenant data breach affecting 200+ organizations\n- Account takeover via profile modification\n\n### Recommendation\n1. Implement server-side authorization checks on every endpoint\n2. Use a centralized authorization middleware\u002Fframework\n3. Enforce object-level authorization (verify ownership before access)\n4. Validate tenant context server-side, never from client headers\n5. Use allowlists for mass assignment (only permit expected fields)\n6. Implement audit logging for all access control decisions\n```\n","# Testing for Broken Access Control\n\n## When to Use\n\n- During authorized penetration tests as the primary assessment for OWASP A01:2021 - Broken Access Control\n- When evaluating role-based access control (RBAC) implementations across all application endpoints\n- For testing multi-tenant applications where users in one organization should not access another's data\n- When assessing API endpoints for missing or inconsistent authorization checks\n- During security audits where privilege escalation and unauthorized access are primary concerns\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Burp Suite Professional**: With Authorize extension for automated access control testing\n- **Multiple test accounts**: Accounts at each role level (admin, manager, user, guest)\n- **Application role matrix**: Documentation of what each role should and should not access\n- **curl\u002Fhttpie**: For manual endpoint testing with different authentication contexts\n- **ffuf**: For discovering hidden endpoints that may lack access controls\n\n## Workflow\n\n### Step 1: Map All Endpoints and Create Access Control Matrix\n\nDocument every endpoint and the expected access level for each role.\n\n```bash\n# Extract all endpoints from Burp Site Map\n# Target > Site Map > Right-click > Copy URLs in this host\n\n# Build a matrix of endpoints vs roles:\n# | Endpoint              | Admin | Manager | User | Guest |\n# |-----------------------|-------|---------|------|-------|\n# | GET \u002Fadmin\u002Fdashboard  | Allow | Deny    | Deny | Deny  |\n# | GET \u002Fapi\u002Fusers        | Allow | Allow   | Deny | Deny  |\n# | PUT \u002Fapi\u002Fusers\u002F{id}   | Allow | Deny    | Own  | Deny  |\n# | DELETE \u002Fapi\u002Fposts\u002F{id} | Allow | Allow   | Own  | Deny  |\n\n# Discover hidden endpoints\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-directories.txt \\\n  -mc 200,301,302,403 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\" \\\n  -o endpoints.json -of json\n\n# API endpoint discovery\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fv1\u002FFUZZ\" \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,302,401,403,405 -fc 404 \\\n  -H \"Authorization: Bearer $USER_TOKEN\"\n```\n\n### Step 2: Configure Automated Access Control Testing\n\nSet up Burp Authorize extension for parallel role-based testing.\n\n```\n# Install Authorize extension:\n# Burp > Extender > BApp Store > Search \"Authorize\" > Install\n\n# Configuration for three-tier testing:\n# 1. Browse the application as Admin (capture all requests)\n# 2. In Authorize tab:\n#    a. Add Regular User's session token in \"Replace cookies\u002Fheaders\"\n#    b. Optionally add a second row for Unauthenticated (no auth header)\n\n# Example header replacement setup:\n# Row 1 (Low-privilege user):\n#   Cookie: session=low_priv_user_session\n#   Authorization: Bearer low_priv_token\n#\n# Row 2 (Unauthenticated):\n#   [Empty - removes all auth headers]\n\n# Enable interception in Authorize:\n# - Check \"Intercept requests from Proxy\"\n# - Check \"Intercept requests from Repeater\"\n\n# Authorize shows results as:\n# Green  = Properly restricted (different response for different user)\n# Red    = POTENTIALLY VULNERABLE (same response regardless of role)\n# Orange = Uncertain (needs manual verification)\n```\n\n### Step 3: Test Vertical Privilege Escalation\n\nAttempt to access higher-privilege functionality with lower-privilege accounts.\n\n```bash\n# Collect tokens for each role\nADMIN_TOKEN=\"Bearer admin_jwt_here\"\nMANAGER_TOKEN=\"Bearer manager_jwt_here\"\nUSER_TOKEN=\"Bearer user_jwt_here\"\n\n# Test admin endpoints with user token\nADMIN_ENDPOINTS=(\n  \"GET \u002Fadmin\u002Fdashboard\"\n  \"GET \u002Fadmin\u002Fusers\"\n  \"POST \u002Fadmin\u002Fusers\u002Fcreate\"\n  \"PUT \u002Fadmin\u002Fsettings\"\n  \"DELETE \u002Fadmin\u002Fusers\u002F5\"\n  \"GET \u002Fadmin\u002Flogs\"\n  \"GET \u002Fadmin\u002Freports\u002Fexport\"\n  \"POST \u002Fadmin\u002Fbackup\"\n)\n\nfor entry in \"${ADMIN_ENDPOINTS[@]}\"; do\n  method=$(echo \"$entry\" | cut -d' ' -f1)\n  endpoint=$(echo \"$entry\" | cut -d' ' -f2)\n  echo -n \"$method $endpoint (as user): \"\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    -H \"Content-Type: application\u002Fjson\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\")\n  if [ \"$status\" == \"200\" ] || [ \"$status\" == \"201\" ]; then\n    echo \"VULNERABLE ($status)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test with method override headers\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -X POST \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"X-HTTP-Method-Override: DELETE\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\u002F5\"\n\n# Test with different HTTP methods\nfor method in GET POST PUT PATCH DELETE OPTIONS HEAD; do\n  echo -n \"$method \u002Fadmin\u002Fusers: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \\\n    -H \"Authorization: $USER_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\"\n  echo\ndone\n```\n\n### Step 4: Test Horizontal Privilege Escalation\n\nVerify that users cannot access resources belonging to other users at the same privilege level.\n\n```bash\n# User A (ID: 101) testing access to User B's (ID: 102) resources\nUSER_A_TOKEN=\"Bearer user_a_jwt\"\n\nRESOURCES=(\n  \"\u002Fapi\u002Fusers\u002F102\u002Fprofile\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Forders\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fmessages\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fdocuments\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fsettings\"\n  \"\u002Fapi\u002Fusers\u002F102\u002Fpayment-methods\"\n)\n\nfor resource in \"${RESOURCES[@]}\"; do\n  echo -n \"GET $resource: \"\n  response=$(curl -s -w \"\\n%{http_code}\" \\\n    -H \"Authorization: $USER_A_TOKEN\" \\\n    \"https:\u002F\u002Ftarget.example.com$resource\")\n  status=$(echo \"$response\" | tail -1)\n  body_len=$(echo \"$response\" | head -n -1 | wc -c)\n  if [ \"$status\" == \"200\" ] && [ \"$body_len\" -gt 50 ]; then\n    echo \"VULNERABLE ($status, $body_len bytes)\"\n  else\n    echo \"OK ($status)\"\n  fi\ndone\n\n# Test write operations across users\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"name\":\"Hacked\",\"email\":\"hacked@evil.com\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fprofile\" -w \"%{http_code}\"\n\n# Test delete operations\ncurl -s -X DELETE \\\n  -H \"Authorization: $USER_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F102\u002Fdocuments\u002F1\" -w \"%{http_code}\"\n```\n\n### Step 5: Test Function-Level Access Control\n\nVerify that specific functions enforce authorization properly.\n\n```bash\n# Test unauthenticated access to protected endpoints\nPROTECTED_ENDPOINTS=(\n  \"\u002Fapi\u002Fuser\u002Fprofile\"\n  \"\u002Fapi\u002Ftransactions\"\n  \"\u002Fapi\u002Fsettings\"\n  \"\u002Fadmin\u002Fdashboard\"\n  \"\u002Fapi\u002Fexport\u002Fusers\"\n)\n\nfor endpoint in \"${PROTECTED_ENDPOINTS[@]}\"; do\n  echo -n \"No auth: GET $endpoint: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Ftarget.example.com$endpoint\"\n  echo\ndone\n\n# Test with expired\u002Finvalid tokens\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -H \"Authorization: Bearer invalid_token_here\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fuser\u002Fprofile\"\n\n# Test role manipulation in JWT claims\n# If JWT contains role claim, try modifying it\n# (requires JWT vulnerability - see JWT testing skill)\n\n# Test parameter-based role escalation\ncurl -s -X PUT \\\n  -H \"Authorization: $USER_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"role\":\"admin\",\"is_admin\":true,\"permissions\":[\"admin\",\"superuser\"]}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\u002F101\u002Fprofile\"\n\n# Test registration with elevated role\ncurl -s -X POST \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"email\":\"new@test.com\",\"password\":\"Test123!\",\"role\":\"admin\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fauth\u002Fregister\"\n```\n\n### Step 6: Test Multi-Tenant Isolation\n\nVerify that tenant boundaries are enforced in multi-tenant applications.\n\n```bash\n# User in Tenant A testing access to Tenant B's resources\nTENANT_A_TOKEN=\"Bearer tenant_a_user_jwt\"\n\n# Direct tenant resource access\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fusers\" | jq .\n\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002Ftenant-b-id\u002Fsettings\" | jq .\n\n# Test tenant switching via header\ncurl -s -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"X-Tenant-ID: tenant-b-id\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Fusers\" | jq .\n\n# Test tenant ID in request body\ncurl -s -X POST \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"tenant_id\":\"tenant-b-id\",\"query\":\"SELECT * FROM users\"}' \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Freports\u002Fcustom\"\n\n# Enumerate tenant IDs\nffuf -u \"https:\u002F\u002Ftarget.example.com\u002Fapi\u002Forganizations\u002FFUZZ\" \\\n  -w \u003C(seq 1 100) \\\n  -H \"Authorization: $TENANT_A_TOKEN\" \\\n  -mc 200 -t 10 -rate 20\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Vertical Privilege Escalation** | Lower-privilege user accessing higher-privilege functionality (user -> admin) |\n| **Horizontal Privilege Escalation** | User accessing another user's resources at the same privilege level |\n| **Function-Level Access Control** | Authorization checks on specific features\u002Ffunctions regardless of URL |\n| **RBAC** | Role-Based Access Control - permissions assigned to roles, roles assigned to users |\n| **ABAC** | Attribute-Based Access Control - permissions based on user\u002Fresource\u002Fenvironment attributes |\n| **Multi-Tenant Isolation** | Ensuring data and functionality separation between different organizations\u002Ftenants |\n| **Insecure Direct Object Reference** | Accessing objects by manipulating identifiers without authorization checks |\n| **Missing Function-Level Check** | Endpoint exists but does not verify the caller has permission to invoke it |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Request interception and role-based testing |\n| **Authorize (Burp Extension)** | Automated access control testing across sessions |\n| **AutoRepeater (Burp Extension)** | Automatically replays requests with different auth contexts |\n| **Postman** | API testing with environment switching between roles |\n| **ffuf** | Discovering hidden endpoints that may lack access controls |\n| **OWASP ZAP** | Access control testing with context-aware scanning |\n\n## Common Scenarios\n\n### Scenario 1: Admin Panel Without Auth Check\nThe `\u002Fadmin\u002Fdashboard` endpoint returns the admin panel when accessed with a regular user's session token. The front-end hides the admin menu, but the back-end does not enforce role checks.\n\n### Scenario 2: API Endpoint Missing Authorization\nThe `DELETE \u002Fapi\u002Fusers\u002F{id}` endpoint checks for authentication (valid token) but not authorization (admin role). Any authenticated user can delete any other user's account.\n\n### Scenario 3: Tenant Data Leakage\nA SaaS application uses `tenant_id` in API request headers. Changing the `X-Tenant-ID` header to another tenant's ID returns their data, bypassing tenant isolation.\n\n### Scenario 4: Mass Assignment Role Escalation\nThe user profile update endpoint at `PUT \u002Fapi\u002Fusers\u002F{id}` accepts a `role` field in the JSON body. Submitting `\"role\":\"admin\"` alongside a profile update elevates the user to administrator.\n\n## Output Format\n\n```\n## Broken Access Control Assessment Report\n\n**Target**: target.example.com\n**Assessment Date**: 2024-01-15\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### Access Control Matrix Results\n| Endpoint | Admin | Manager | User | Guest | Expected | Actual |\n|----------|-------|---------|------|-------|----------|--------|\n| GET \u002Fadmin\u002Fdashboard | 200 | 200 | 200 | 302 | Admin only | FAIL |\n| DELETE \u002Fapi\u002Fusers\u002F{id} | 200 | 200 | 200 | 401 | Admin only | FAIL |\n| GET \u002Fapi\u002Fusers\u002Fother\u002Fprofile | 200 | 200 | 200 | 401 | Own only | FAIL |\n| PUT \u002Fapi\u002Fusers\u002Fother\u002Fsettings | 200 | 200 | 200 | 401 | Own only | FAIL |\n| GET \u002Fapi\u002Forg\u002Fother-tenant | 200 | 200 | 200 | 401 | Same tenant | FAIL |\n\n### Critical Findings\n1. **Vertical Escalation**: Regular users can access \u002Fadmin\u002F* endpoints\n2. **Horizontal IDOR**: Users can read\u002Fmodify other users' profiles\n3. **Tenant Isolation**: Cross-tenant data access via header manipulation\n4. **Mass Assignment**: Role escalation via profile update endpoint\n\n### Impact\n- Complete administrative access for any authenticated user\n- Full user data access across all accounts (15,000+ users)\n- Cross-tenant data breach affecting 200+ organizations\n- Account takeover via profile modification\n\n### Recommendation\n1. Implement server-side authorization checks on every endpoint\n2. Use a centralized authorization middleware\u002Fframework\n3. Enforce object-level authorization (verify ownership before access)\n4. Validate tenant context server-side, never from client headers\n5. Use allowlists for mass assignment (only permit expected fields)\n6. Implement audit logging for all access control decisions\n```\n",{"name":5,"tags":52,"author":53,"domain":45,"license":15,"version":54,"nist_csf":55,"subdomain":35,"description":7,"mitre_attack":60},[40,38,36,37,41,33],"mahipal","1.0",[56,57,58,59],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[61,62,63,64,65],"T1190","T1059.007","T1505.003","T1083","T1068","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Ftesting-for-broken-access-control",4425,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-broken-access-control",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-broken-access-control",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-broken-access-control","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-broken-access-control\u002FSKILL.md",true,[90,95,101],{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-broken-access-control\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",2001,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-broken-access-control\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",8889,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-broken-access-control\u002Fscripts\u002Fagent.py",[108,133,157,182,207,234],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[114],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118,119,46,45,120,121,42,122,123,124,125,126,127,128,129,130,131,132],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[139],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[141,129,142,143,46,144,45,42,145,146,147,148,149,150,151,152,153,154,155,156],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":165,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[163,164],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[151,166,167,168,28,45,169,170,145,171,172,173,174,175,176,177,178,179,180,181],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[188],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,192,45,193,194,195,196,197,198,199,39,200,201,202,203,148,204,205,206],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[213],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,45,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[240],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[46,242,45,243,244,245,246,247,248,249,250,177,251,178,252,253,254,255,256,257],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]