hunt-idor

Name: hunt-idor
Availability: InStock
Author: pdparchitect

Identify and validate insecure direct object reference vulnerabilities in web applications and APIs.

13|2|Updated Jun 1, 2026

Search Tags:#security #api-security #pentesting #bug-hunting #idor #vulnerability-research

Ready to run

npx skills add https://github.com/pdparchitect/rook --skill hunt-idor-pdparchitect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-idor
Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-idor
Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-idor-pdparchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the critical security gap where applications fail to verify object ownership, allowing unauthorized access to private user data or state-changing operations.

Core Features & Use Cases

Vulnerability Mapping: Provides a structured methodology to identify insecure direct object references across REST and GraphQL APIs.
Exploitation Chains: Offers advanced guidance on chaining IDORs with other primitives to achieve account takeover, financial fraud, or privilege escalation.
Use Case: Use this skill to audit a multi-tenant SaaS application for cross-tenant data leakage by testing resource IDs across different user sessions.

Quick Start

Use the hunt-idor skill to audit the current repository for missing ownership checks in API endpoints and database queries.

Frequently Asked Questions about hunt-idor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for IDOR vulnerabilities in a multi-tenant SaaS application?▼

To test for IDOR vulnerabilities in a multi-tenant SaaS application, you systematically probe RESTful parameters and GraphQL resolvers across different user sessions to detect unauthorized cross-tenant data access. This identifies missing object ownership checks.

What is an insecure direct object reference flaw in web APIs?▼

An insecure direct object reference flaw occurs when web applications or API architectures fail to verify object ownership, allowing unauthorized access to private user data or state-changing operations across RESTful and GraphQL endpoints.

Can I chain IDOR exploits with other vulnerabilities for account takeover?▼

Yes, you can chain IDOR exploits with other primitives to achieve account takeover, financial fraud, or privilege escalation. The methodology offers advanced guidance on exploiting state-changing HTTP methods for broader security impacts.

Does this IDOR testing methodology cover GraphQL resolvers and state-changing HTTP methods?▼

Yes, this IDOR testing methodology rigorously tests GraphQL resolvers and state-changing HTTP methods. It implements comprehensive testing protocols to ensure full security coverage for both RESTful parameters and GraphQL architectures.

What is the best way to audit administrative interfaces for missing ownership checks?▼

The best way to audit administrative interfaces for missing ownership checks is to map and validate insecure direct object references using structured testing protocols. This detects unauthorized cross-user data access in financial platforms.