exploiting-broken-function-level-authorization - Test APIs for broken function-level authorization
Tests APIs for broken function-level authorization by finding privileged endpoints and probing them with regular-user credentials.
Tags
Updated: 2026-10-01Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Discover administrative endpoints
- Test role-based access
- Switch HTTP methods
- Tamper with parameters
- Test API path variants
- Identify privilege escalation
Inputs
- Written authorization scope
- Target API
- Privilege-level accounts
- API documentation
- API request credentials
Outputs
- Endpoint access results
- Role-based access results
- BFLA findings
- Privilege escalation results
Requirements
- Written authorization
- Burp Suite Professional
- Python 3.10 or later
- Python requests library