idor

What problem does it solve?

This Skill helps penetration testers identify and exploit Insecure Direct Object Reference (IDOR) and broken access control vulnerabilities, allowing unauthorized access to sensitive data or functionality.

Core Features & Use Cases

• ID Enumeration: Test sequential, UUID, and other ID formats across various injection points (URL, POST body, headers).
• Access Control Testing: Verify if low-privilege users can access higher-privilege functions or other users' data.
• Use Case: A penetration tester suspects an API endpoint /api/users/{id}/profile is vulnerable to IDOR. They use this Skill to systematically test different user IDs while authenticated as a low-privilege user to see if they can access other users' profiles or administrative functions.

Quick Start

Use the idor skill to test for horizontal privilege escalation on the target endpoint '/api/users/123/profile' using your current session.