mirror of
https://github.com/Shiva108/ai-llm-red-team-handbook.git
synced 2026-02-13 07:02:45 +00:00
b3d3bac51f
- Extracted all code examples from handbook chapters - Organized into 15 attack categories - Created shared utilities (api_client, validators, logging, constants) - Added workflow orchestration scripts - Implemented install.sh for easy setup - Renamed all scripts to descriptive functional names - Added comprehensive README and documentation - Included pytest test suite and configuration
41 lines
1000 B
Python
41 lines
1000 B
Python
#!/usr/bin/env python3
|
|
"""
|
|
17.10.2 Authorization Testing
|
|
|
|
Source: Chapter_17_05_Third_Party_Risks_and_Testing
|
|
Category: plugin_exploitation
|
|
"""
|
|
|
|
import argparse
|
|
import sys
|
|
|
|
class AuthzTester:
|
|
"""Test authorization controls"""
|
|
|
|
def test_idor(self, base_url, user_token):
|
|
"""Test for IDOR vulnerabilities"""
|
|
findings = []
|
|
|
|
for user_id in range(1, 100):
|
|
url = f"{base_url}/api/users/{user_id}"
|
|
response = requests.get(url, headers={
|
|
'Authorization': f'Bearer {user_token}'
|
|
})
|
|
|
|
if response.status_code == 200:
|
|
findings.append(f"Accessed user {user_id}")
|
|
|
|
return findings
|
|
|
|
|
|
def main():
|
|
"""Command-line interface."""
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("--verbose", "-v", action="store_true", help="Verbose output")
|
|
args = parser.parse_args()
|
|
|
|
# TODO: Add main execution logic
|
|
pass
|
|
|
|
if __name__ == "__main__":
|
|
main() |