skills.rest
baiqigo
baiqigoCOMMUNITY
Explore all skills by this author →
GitHub

hunt-idor

Detects and validates IDOR vulnerabilities in APIs using evidence-gated black-box testing methodology.

10|3|Updated Aug 10, 2026
Search Tags:#access control#penetration testing#graphql#api security#bug bounty#idor#burp suite
One-click install
npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-idor-baiqigo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-idor
Source: https://github.com/baiqigo/baiqi-redteam-lab/tree/main/.agents/skills/hunt-idor
Command: npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-idor-baiqigo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Insecure Direct Object Reference (IDOR) flaws let attackers access other users' data by swapping object IDs, but they are easy to miss and hard to prove. This Skill provides a structured, evidence-gated methodology for finding, validating, and documenting IDOR vulnerabilities during authorized bug bounty hunting and security assessments. ## Core Features & Use Cases - Attack Surface Mapping: Identifies IDOR-prone URL patterns, JavaScript object references, GraphQL resolvers, and multi-tenant parameters across REST and GraphQL APIs. - Two-Account Validation Methodology: Guides replaying User A's resource IDs with User B's session across all HTTP verbs, including cross-tenant and destructive operation tests. - Chain Composition Playbooks: Documents six high-impact chains combining IDOR with password reset, mass assignment, GraphQL node traversal, and refund endpoints to escalate read-only findings into account takeover or financial impact. - Use Case: While testing a SaaS billing API, use this Skill to enumerate invoice endpoints, replay a victim's invoice ID with your own session token, confirm the 200 OK data leak, and document a reproducible report that passes triage. ## Quick Start Use the hunt-idor skill to plan an authorized IDOR test against the target application's API endpoints with two test accounts.

Frequently Asked Questions about hunt-idor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for IDOR vulnerabilities in an API?▼

Create two accounts at the same privilege level, capture User A's resource IDs while authenticated, then replay those requests with User B's session token. Test all HTTP verbs including GET, PUT, PATCH, and DELETE, and confirm a 200 response containing User A's data.

What tools are used for IDOR detection and enumeration?▼

Burp Suite captures and replays authenticated requests, ffuf enumerates sequential object IDs with filtered status codes, and curl scripts test individual endpoints. JavaScript bundle analysis with grep reveals leaked UUIDs and hardcoded object references.

Can IDOR vulnerabilities exist in GraphQL APIs?▼

Yes, GraphQL resolvers often lack field-level authorization, making them IDOR-prone by default. Run introspection to enumerate queries and mutations accepting id arguments, then substitute victim IDs, especially through Relay-style node(id:) global identifiers.

How do I bypass UUID-based IDOR protections?▼

UUIDs frequently leak through other API responses, notification emails, webhooks, JavaScript source, or GraphQL queries. Harvest victim UUIDs from accessible endpoints, then replay them against restricted endpoints that only check authentication rather than ownership.

Why does my IDOR report get marked as not applicable?▼

The most common rejection cause is a 200 response that returns no actual victim data, such as empty arrays or redacted fields. Validate that the response contains real confidential data and that the finding is reproducible from two fresh accounts within ten minutes.

What is the difference between IDOR and broken access control?▼

IDOR is a specific form of broken object-level authorization where the server fails to verify the requester owns the referenced object. It differs from route-level authentication bypass, where endpoints lack any login requirement at all.

Related Skills

Explore More Software Engineering Skills→
hhjkjkjkhhjkjkjk

hunt-idor

Detects IDOR vulnerabilities in APIs and web applications using two-account authorization testing.

Community
Advanced
Mikacr1138Mikacr1138
2

report-writing

Generate impact-first bug bounty reports with CVSS 3.1 scoring and pre-submit checklists.

Community
Advanced
chatbotkitchatbotkit
13

hunt-idor

Identify and exploit IDOR vulnerabilities in multi-tenant apps and APIs.

Official
Advanced
chengzongcaichengzongcai
21

code-audit

Reviews source code for security vulnerabilities using Semgrep, CodeQL, and manual verification workflows.

Community
Intermediate