skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

idor-broken-object-authorization

Detect IDOR and broken object level authorization across web and API requests.

241|28|Updated May 20, 2026
Search Tags:#multi-tenant#security testing#api testing#idor#bola#broken authorization#request replay
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill idor-broken-object-authorization-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: idor-broken-object-authorization
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/idor-broken-object-authorization
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill idor-broken-object-authorization-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps security testers detect and validate IDOR/BOLA weaknesses where attackers can access or modify other users’ objects by swapping object identifiers across endpoints, methods, and request locations.

Core Features & Use Cases

  • Comprehensive ID discovery: Covers IDs in path, query, body, headers, cookies, GraphQL, and other transport mechanisms to avoid missing non-obvious surfaces.
  • A-B authorization validation workflow: Guides testers to replay captured requests from UserA against UserB to confirm broken object-level authorization with clear evidence.
  • Attack breadth for higher impact: Includes method escalation (GET/POST/PUT/PATCH/DELETE), indirect reference-chain IDOR, mass assignment to hidden fields, state-machine abuse, and BFLA-style function-level checks when authorization boundaries are violated.

Use it when you are performing web/API black-box testing for multi-tenant apps, account-driven object access (profiles, orders, invoices, attachments), file/object reference hierarchies, and privilege boundary enforcement.

Quick Start

Ask the AI to generate an IDOR/BOLA test plan for a target API by enumerating all object ID locations it can appear in, then perform A-B request replay steps using UserA and UserB and produce an evidence checklist for read/modify/delete outcomes.

Frequently Asked Questions about idor-broken-object-authorization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for IDOR and broken object level authorization in a multi-tenant API?▼

To test for IDOR and broken object level authorization, systematically locate object identifiers across URL paths, query parameters, bodies, headers, and GraphQL arguments, then replay requests across two user sessions to validate authorization boundaries. This A-B methodology confirms if objects are bound to the correct principal.

What is the A-B testing methodology for detecting BOLA vulnerabilities?▼

The A-B testing methodology for BOLA involves capturing requests from UserA and replaying them against UserB to detect broken object-level authorization. By systematically mutating parameters and payload locations, testers produce structured evidence of read, write, and delete effects on unauthorized objects.

Can I use request replay to find IDOR vulnerabilities across different HTTP methods?▼

Yes, request replay can find IDOR vulnerabilities across different HTTP methods by escalating from GET to POST, PUT, PATCH, and DELETE. This broad HTTP method coverage validates read, write, and delete effects on referenced objects to uncover deeper authorization gaps.

How do I find non-obvious object identifiers in GraphQL and HTTP headers for security testing?▼

To find non-obvious object identifiers in GraphQL and HTTP headers for security testing, systematically scan all transport mechanisms including cookies, query parameters, and body payloads. Comprehensive ID discovery avoids missing hidden surfaces where predictable IDs might expose authorization gaps.

Does IDOR testing cover mass assignment and parameter pollution attacks?▼

Yes, IDOR testing covers mass assignment to hidden fields and parameter pollution attacks. It includes method escalation, indirect reference-chain IDOR, and type confusion to maximize attack breadth and detect higher impact authorization boundary violations.

What do I need to perform broken object level authorization testing on web applications?▼

To perform broken object level authorization testing on web applications, you need two separate user accounts within the multi-tenant environment. This A-B setup allows you to replay requests across sessions and validate whether authorization checks correctly restrict access to referenced objects.

Related Skills

Explore More Education & Research Skills→
AcczdyAcczdy
2

testing-api-for-broken-object-level-authorization

Detect broken object level authorization in REST and GraphQL APIs.

Community
Intermediate
Patasse97Patasse97

security-pen-testing

Detect vulnerabilities in web applications, APIs, and infrastructure via authorized penetration testing.

Community
Advanced
jcastillotxjcastillotx

Burp Suite Web Application Testing

Intercept and analyze HTTP traffic with Burp Suite proxy tools.

Community
Advanced
sayseven7sayseven7
11

idor-broken-object-authorization

Compare authenticated requests across users to detect IDOR, BOLA, and BFLA authorization gaps.

Community
Advanced