mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

2.3 KiB

Raw Blame History

API Reference: Broken Function Level Authorization (BFLA)

OWASP API5:2023 — Broken Function Level Authorization

Description

API endpoints expose functions that should be restricted to specific roles. Low-privileged users can invoke admin-level functionality.

Common Patterns

Pattern	Example
Guessable admin paths	`/api/admin/users`
Method switching	POST allowed but PUT bypasses auth
Role parameter manipulation	`{"role": "admin"}` in request
Vertical privilege escalation	User accessing admin endpoints

Testing Methodology

Step 1: Discover Endpoints

# From OpenAPI spec
curl https://api.target.com/swagger.json | jq '.paths | keys'

# From JavaScript source
grep -oP '["'"'"']/api/[^"'"'"']+' app.js

Step 2: Test with Low-Priv Token

curl -H "Authorization: Bearer <low_priv_token>" \
     https://api.target.com/api/admin/users

Step 3: Test HTTP Method Switching

# If GET returns 403, try POST/PUT/DELETE
curl -X PUT -H "Authorization: Bearer <low_priv_token>" \
     https://api.target.com/api/admin/users/1

Python requests Library

Request with Token

headers = {"Authorization": f"Bearer {token}"}
resp = requests.get(url, headers=headers, timeout=10, verify=False)

Method Switching

for method in ["GET", "POST", "PUT", "DELETE", "PATCH"]:
    resp = requests.request(method, url, headers=headers, timeout=10)
    if resp.status_code < 400:
        print(f"Accessible via {method}: {resp.status_code}")

Common Admin Endpoints to Test

/admin
/api/admin
/api/v1/admin/users
/api/internal
/manage
/api/config
/api/debug
/api/users/all
/api/system/settings
/graphql (with admin mutations)

Burp Suite — Authorization Testing

Autorize Extension

Install Autorize from BApp Store
Set low-privilege cookie/token
Browse application as admin
Autorize replays requests with low-priv token
Compare responses for authorization bypass

Response Analysis

Indicator	Meaning
200 with data	Full access (vulnerability)
200 empty body	Possible partial bypass
403 Forbidden	Properly restricted
401 Unauthorized	Auth required
405 Method Not Allowed	Method restricted

2.3 KiB Raw Blame History