[
  {
    "id": "SVC-AUTK-001",
    "payload": "/application/o/authorize/?client_id=test&redirect_uri=https://evil.com/callback&response_type=code",
    "tags": ["oauth", "open-redirect", "quick", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "OAuth open redirect to malicious callback URL",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/application/o/authorize/"
  },
  {
    "id": "SVC-AUTK-002",
    "payload": "/application/o/authorize/?client_id=test&redirect_uri=javascript:alert(document.cookie)&response_type=code",
    "tags": ["oauth", "xss", "quick", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "OAuth redirect with javascript: scheme (XSS)",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/application/o/authorize/"
  },
  {
    "id": "SVC-AUTK-003",
    "payload": "/application/o/authorize/?client_id=test&redirect_uri=data:text/html,<script>alert(1)</script>&response_type=code",
    "tags": ["oauth", "xss", "data-uri", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "OAuth redirect with data: URI (XSS)",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/application/o/authorize/"
  },
  {
    "id": "SVC-AUTK-004",
    "payload": "/application/o/authorize/?client_id=test&redirect_uri=http://localhost:8080@attacker.com&response_type=code",
    "tags": ["oauth", "open-redirect", "url-parsing", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "OAuth redirect with URL parsing confusion (@)",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/application/o/authorize/"
  },
  {
    "id": "SVC-AUTK-005",
    "payload": "/application/o/authorize/?client_id=test&redirect_uri=https://auth.example.com.evil.com&response_type=code",
    "tags": ["oauth", "open-redirect", "subdomain-takeover", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "OAuth redirect to lookalike domain (subdomain prefix)",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/application/o/authorize/"
  },
  {
    "id": "SVC-AUTK-006",
    "payload": "/source/saml/<slug>/acs/",
    "method": "POST",
    "body": "SAMLResponse=PD94bWwgdmVyc2lvbj0iMS4wIj8+PCFET0NUWVBFIGZvbyBbPCFFTlRJVFkgeHhlIFNZU1RFTSAiZmlsZTovLy9ldGMvcGFzc3dkIj5dPjxzYW1scDpSZXNwb25zZT4meHhlOzwvc2FtbHA6UmVzcG9uc2U+",
    "tags": ["saml", "xxe", "quick", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "SAML XXE attack attempting to read /etc/passwd",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/source/saml/<slug>/acs/"
  },
  {
    "id": "SVC-AUTK-007",
    "payload": "/source/saml/<slug>/acs/",
    "method": "POST",
    "body": "SAMLResponse=PHNhbWxwOlJlc3BvbnNlPjxzYW1sOkFzc2VydGlvbj48c2FtbDpBdHRyaWJ1dGVTdGF0ZW1lbnQ+PHNhbWw6QXR0cmlidXRlIE5hbWU9InJvbGUiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlPmFkbWluPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PC9zYW1sOkF0dHJpYnV0ZVN0YXRlbWVudD48L3NhbWw6QXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9uc2U+",
    "tags": ["saml", "injection", "privilege-escalation", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "SAML attribute injection - injecting admin role",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/source/saml/<slug>/acs/"
  },
  {
    "id": "SVC-AUTK-008",
    "payload": "/api/v3/core/users/",
    "method": "POST",
    "body": "{\"username\":\"attacker\",\"email\":\"test@test.com\",\"is_superuser\":true,\"is_staff\":true}",
    "tags": ["api", "mass-assignment", "privilege-escalation", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "User provisioning mass assignment - creating superuser",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/core/users/"
  },
  {
    "id": "SVC-AUTK-009",
    "payload": "/api/v3/core/users/",
    "method": "POST",
    "body": "{\"username\":\"attacker2\",\"email\":\"test@test.com\",\"groups\":[\"administrators\",\"superusers\"]}",
    "tags": ["api", "mass-assignment", "group-escalation", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "User provisioning with privileged group assignment",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/core/users/"
  },
  {
    "id": "SVC-AUTK-010",
    "payload": "/api/v3/core/users/",
    "method": "POST",
    "body": "{\"username\":\"attacker3\",\"email\":\"test@test.com\",\"permissions\":[\"*\"]}",
    "tags": ["api", "mass-assignment", "wildcard-permission", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "User provisioning with wildcard permissions",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/core/users/"
  },
  {
    "id": "SVC-AUTK-011",
    "payload": "/flows/executor/test/?query={{%20'7'*7%20}}",
    "tags": ["ssti", "template-injection", "quick", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Flow executor template injection (Jinja2)",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/flows/executor/"
  },
  {
    "id": "SVC-AUTK-012",
    "payload": "/flows/executor/test/?query={{config.items()}}",
    "tags": ["ssti", "info-disclosure", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Flow executor attempting to leak config via template",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/flows/executor/"
  },
  {
    "id": "SVC-AUTK-013",
    "payload": "/flows/executor/test/?query={{''.__class__.__mro__[1].__subclasses__()}}",
    "tags": ["ssti", "rce", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Flow executor Python object traversal for RCE",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/flows/executor/"
  },
  {
    "id": "SVC-AUTK-014",
    "payload": "/flows/executor/test/?query=${7*7}",
    "tags": ["ssti", "el-injection", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Flow executor EL expression injection",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/flows/executor/"
  },
  {
    "id": "SVC-AUTK-015",
    "payload": "/flows/executor/test/?query=<%=7*7%>",
    "tags": ["ssti", "erb-injection", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Flow executor ERB template injection",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/flows/executor/"
  },
  {
    "id": "SVC-AUTK-016",
    "payload": "/application/o/token/",
    "method": "POST",
    "body": "grant_type=password&username=admin&password=admin",
    "tags": ["oauth", "token", "brute-force", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Token endpoint password grant type (credential stuffing)",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/application/o/token/"
  },
  {
    "id": "SVC-AUTK-017",
    "payload": "/application/o/token/",
    "method": "POST",
    "body": "grant_type=client_credentials&client_id=test&client_secret=",
    "tags": ["oauth", "token", "empty-secret", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Token endpoint with empty client secret",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/application/o/token/"
  },
  {
    "id": "SVC-AUTK-018",
    "payload": "/application/o/token/",
    "method": "POST",
    "body": "grant_type=refresh_token&refresh_token=../../../etc/passwd",
    "tags": ["oauth", "token", "traversal", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Token endpoint with path traversal in refresh token",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/application/o/token/"
  },
  {
    "id": "SVC-AUTK-019",
    "payload": "/application/o/token/",
    "method": "POST",
    "body": "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJpc3MiOiJhdHRhY2tlciJ9.",
    "tags": ["oauth", "token", "jwt-bearer", "algorithm-confusion", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "JWT bearer grant with 'none' algorithm",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/application/o/token/"
  },
  {
    "id": "SVC-AUTK-020",
    "payload": "/if/flow/recovery/?token=admin",
    "tags": ["account-takeover", "token-prediction", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Password reset with predictable token",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/if/flow/recovery/"
  },
  {
    "id": "SVC-AUTK-021",
    "payload": "/if/flow/recovery/?token=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
    "tags": ["account-takeover", "token-enumeration", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Password reset with sequential UUID enumeration",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/if/flow/recovery/"
  },
  {
    "id": "SVC-AUTK-022",
    "payload": "/if/flow/recovery/?token[]=multi&token[]=value",
    "tags": ["account-takeover", "array-injection", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Password reset with array parameter pollution",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/if/flow/recovery/"
  },
  {
    "id": "SVC-AUTK-023",
    "payload": "/if/flow/recovery/?token=../admin",
    "tags": ["account-takeover", "traversal", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Password reset with path traversal in token",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/if/flow/recovery/"
  },
  {
    "id": "SVC-AUTK-024",
    "payload": "/api/v3/stages/email/verify/",
    "method": "POST",
    "body": "{\"email\":\"attacker@test.com\",\"token\":\"0\",\"user_id\":\"1\"}",
    "tags": ["account-takeover", "verification-bypass", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Email verification bypass with null token and user ID injection",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/stages/email/verify/"
  },
  {
    "id": "SVC-AUTK-025",
    "payload": "/api/v3/stages/email/verify/",
    "method": "POST",
    "body": "{\"email\":\"victim@test.com\",\"verified\":true}",
    "tags": ["account-takeover", "verification-bypass", "mass-assignment", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Email verification bypass via mass assignment",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/stages/email/verify/"
  },
  {
    "id": "SVC-AUTK-026",
    "payload": "/api/v3/stages/email/verify/",
    "method": "POST",
    "body": "{\"email\":\"test@test.com\",\"skip_verification\":true}",
    "tags": ["account-takeover", "verification-bypass", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Email verification skip flag injection",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/stages/email/verify/"
  },
  {
    "id": "SVC-AUTK-027",
    "payload": "/api/v3/core/authenticated_sessions/?session_id=attacker_session",
    "tags": ["session-fixation", "session-hijacking", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Session fixation via custom session ID",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/core/authenticated_sessions/"
  },
  {
    "id": "SVC-AUTK-028",
    "payload": "/application/o/authorize/?session_state=fixed_session_123",
    "tags": ["oauth", "session-fixation", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "OAuth session fixation via session_state parameter",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/application/o/authorize/"
  },
  {
    "id": "SVC-AUTK-029",
    "payload": "/api/v3/admin/",
    "tags": ["forced-browsing", "admin-access", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Unauthenticated admin API access attempt",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/admin/"
  },
  {
    "id": "SVC-AUTK-030",
    "payload": "/.well-known/openid-configuration",
    "tags": ["info-disclosure", "oidc-discovery", "low"],
    "expected_block": false,
    "severity_hint": "Low",
    "notes": "OIDC discovery endpoint (should be public but monitored)",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/.well-known/openid-configuration"
  },
  {
    "id": "SVC-AUTK-031",
    "payload": "/api/v3/flows/bindings/?stage=../../admin/users",
    "tags": ["flow", "traversal", "privilege-escalation", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Flow bindings with path traversal to admin users",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/flows/bindings/"
  },
  {
    "id": "SVC-AUTK-032",
    "payload": "/api/v3/stages/prompt/prompts/",
    "method": "POST",
    "body": "{\"field_key\":\"{{constructor.constructor('return process')()}}\",\"label\":\"test\"}",
    "tags": ["stage", "ssti", "prompt-injection", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Prompt stage with SSTI in field_key",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/stages/prompt/prompts/"
  },
  {
    "id": "SVC-AUTK-033",
    "payload": "/application/saml/test/metadata/?download=../../admin/config.xml",
    "tags": ["saml", "traversal", "info-disclosure", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "SAML metadata with path traversal in download parameter",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/application/saml/{slug}/metadata/"
  },
  {
    "id": "SVC-AUTK-034",
    "payload": "/api/v3/outposts/instances/?provider=*",
    "tags": ["outpost", "enumeration", "wildcard-injection", "high"],
    "expected_block": true,
    "severity_hint": "High",
    "notes": "Outpost enumeration with wildcard provider filter",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/outposts/instances/"
  },
  {
    "id": "SVC-AUTK-035",
    "payload": "/api/v3/core/tokens/",
    "method": "POST",
    "body": "{\"identifier\":\"admin\",\"intent\":\"api\",\"expiring\":false}",
    "tags": ["token", "privilege-escalation", "non-expiring", "critical"],
    "expected_block": true,
    "severity_hint": "Critical",
    "notes": "Non-expiring API token creation for admin user",
    "category": "Service-Specific",
    "service": "authentik",
    "endpoint": "/api/v3/core/tokens/"
  }
]