skills.rest
yaklang
yaklangOFFICIAL
Explore all skills by this author →
GitHub

idor-broken-object-authorization

Detect insecure direct object references and broken object-level authorization in web and API endpoints.

1.6k|204|Updated Apr 7, 2026
Search Tags:#api-security#pentesting#idor#mass-assignment#bola#orm-injection#authorization-testing
One-click install
npx skills add https://github.com/yaklang/hack-skills --skill idor-broken-object-authorization
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: idor-broken-object-authorization
Source: https://github.com/yaklang/hack-skills/tree/main/skills/idor-broken-object-authorization
Command: npx skills add https://github.com/yaklang/hack-skills --skill idor-broken-object-authorization

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a systematic playbook to discover and validate insecure direct object references, broken object-level authorization (BOLA), and related function-level flaws across web and API surfaces so testers stop missing high-impact, low-noise vulnerabilities.

Core Features & Use Cases

  • Comprehensive discovery methodology: A-B testing workflow to compare requests between accounts, mapping all locations where object IDs appear (path, query, body, headers, cookies, GraphQL args, WebSockets).
  • Multi-vector exploitation checklist: HTTP verb escalation, parameter pollution, type confusion, mass-assignment, state-machine abuse, indirect IDOR via reference chains, and nested/sub-resource attacks.
  • Backend-specific techniques: Guidance for ORM filter-injection (Django, Prisma, Ransack) and predictable UUID/ID enumeration to extract or manipulate data.
  • Use Cases: Bug bounty reports, penetration tests, API security reviews, CTF challenges, and defensive audits to harden authorization logic.

Quick Start

Create two accounts, perform all actions as AccountA while capturing requests, then replay those requests as AccountB to determine if AccountB can read or modify AccountA's resources.

Frequently Asked Questions about idor-broken-object-authorization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for broken object-level authorization in REST and GraphQL APIs?▼

You test broken object-level authorization by performing A-B testing between two accounts, replaying requests from AccountA as AccountB to check for unauthorized read or write access to object IDs in paths, queries, headers, or bodies.

What is the best way to detect IDOR and BOLA vulnerabilities during a penetration test?▼

The best way to detect IDOR and BOLA vulnerabilities is applying a systematic testing methodology that checks HTTP verb escalation, parameter pollution, and mass-assignment across all request locations to identify read, write, and privilege escalation vectors.

How does ORM filter-injection work for authorization testing in frameworks like Django or Prisma?▼

ORM filter-injection exploits backend authorization flaws by manipulating query parameters to alter ORM filters in frameworks like Django, Prisma, or Ransack, allowing testers to extract or manipulate unauthorized data.

Can I use mass-assignment and parameter pollution checks for API security assessments?▼

Yes, you can use mass-assignment and parameter pollution checks during API security assessments to identify state-machine abuse and privilege escalation vectors by manipulating object IDs and request payloads.

When do I need to check for indirect IDOR via reference chains and sub-resource traversal?▼

You need to check for indirect IDOR via reference chains and sub-resource traversal when object-level authorization flaws might be chained, allowing access to nested resources or predictable UUID and ID enumeration across web endpoints.

Related Skills

Explore More Software Engineering Skills→
jcastillotxjcastillotx

IDOR Vulnerability Testing

Identify and test IDOR vulnerabilities by manipulating object references across API endpoints.

Community
Advanced
langbyyilangbyyi
96

idor-broken-object-authorization

Identify IDOR and BOLA vulnerabilities in web applications, REST APIs, and GraphQL services.

Community
Advanced
riandeoliveirariandeoliveira

testing-api-for-broken-object-level-authorization

Replay authenticated REST and GraphQL requests with swapped object identifiers to detect BOLA and IDOR exposure.

Community
Advanced
EntroVyxEntroVyx
3

hunt-api-misconfig

Probe HTTP parameters and headers to detect API security misconfigurations.

Community
Advanced