Developers
Results screen
For each flaw: reproduction steps, response comparison per account, and raw requests and responses. Personal data in responses is masked.
We swap requests between 2-3 test accounts to test 6 kinds of authorization flaws. Results come as a report with reproduction steps and fixes.
Product name gate · gate.define404.com · Beta
01Test categories
We test these 6, switching accounts as we go
Each category carries its standard reference numbers. The same numbers appear in the report's standards mapping.
G-01
Access to other users' data
Account B sends read and update requests using an order number created by Account A. If it opens and A's values show, that's a flaw.
What we send
GET /api/orders/10482OWASP API1 · Security Measures Standard Art. 5 · ISMS-P 2.5.1
G-02
Admin function calls
We call routes seen only from the admin account using a regular member's token. If a response comes back, that's a flaw.
What we send
GET /api/admin/membersOWASP API5 · Security Measures Standard Art. 5 · ISMS-P 2.5.1
G-03
Privilege field tampering
We slip values like role and is_admin into sign-up and update requests, then read the record back. If the value changed, that's a flaw.
What we send
POST /api/users {"role":"admin"}OWASP API3 · Security Measures Standard Art. 5 · ISMS-P 2.8.1
G-04
Unauthenticated writes
We call write routes without signing in. If they aren't blocked, that's a flaw. Off by default and enabled only on test URLs.
What we send
POST /api/orders (no token)OWASP API2 · Korean standards mapping pending
G-05
File path manipulation
We put ../ or another user's file number into download paths. If a file comes down, that's a flaw.
What we send
GET /api/files/../other-user.pdfOWASP API1 · Korean standards mapping pending
G-06
Error exposure
We send requests for nonexistent resources and invalid values. A 500 error or a visible server path or stack trace is a flaw.
What we send
GET /api/orders/99999999OWASP API8
02How you get results
Results screen, report, verification link
The same results, shown three ways for three kinds of readers.
Whole team
Korean report
A PDF and web view with a cover, counts by severity, a flaw index, a chapter per flaw, and the standards mapping.
Commissioning company
Verification link
Shows only pass or fail per category and the last test time, no sign-in needed. You can turn it off anytime.
03Retest
Retest a single flaw after fixing it
There are five verdicts: Fixed, Still vulnerable, Not tested, Failed, and Pending. History is kept for every run.
