Tel-U Service Desk Breacher
An archived Python CLI that documented broken authorization boundaries in a university service-desk workflow.
This page preserves Tel-U Service Desk Breacher as historical security research. The repository implemented a Python command-line client around authorization flaws described as Broken Access Control, parameter tampering, and insecure direct object references in a service-desk application.
What was built
A Click-based CLI coordinated authentication, service-desk API requests, pagination, output formatting, and explicit confirmations before write operations. Selenium and a browser-login helper supported the existing SSO flow, while a local configuration layer persisted session state.
Security finding
The project demonstrated that user-controlled identifiers were trusted across ticket-list, ticket-detail, attachment, creation, and comment workflows. In security terms, the central lesson is that authentication alone does not replace object-level and function-level authorization on every server-side request.
Engineering details
- Python package split into CLI, authentication, API, browser-login, and formatting responsibilities
- Status-aware pagination with list, detail, and JSON output modes
- Interactive previews and confirmation gates before state-changing requests
- Apache-2.0 licensed public repository, now read-only on GitHub