Test API endpoints with two accounts to detect IDOR vulnerabilities.
npx skills add https://github.com/AshtonVaughan/bountyhound --skill idor-harness
Please help me install this Agent Skill. Skill: idor-harness Source: https://github.com/AshtonVaughan/bountyhound/tree/main/bountyhound/skills/idor-harness Command: npx skills add https://github.com/AshtonVaughan/bountyhound --skill idor-harness
Systematic IDOR testing identifies authorization weaknesses by simulating multi-account scenarios to reveal improper access control and data exposure.
Set up two distinct test accounts and run the automated harness against a target to identify IDOR vulnerabilities.
High-intent search queries and answers about installing and using this skill.
IDOR testing identifies authorization weaknesses by simulating multi-account scenarios. You set up two distinct test accounts and run an automated harness against target endpoints to detect improper access control and data exposure.
Horizontal IDOR involves accessing data of peer-level users, while vertical IDOR involves privilege escalation to higher roles. The two-account harness enumerates and validates both types of user-specific data exposure across multiple API surfaces.
API access control gaps are detected by applying a two-account harness that authenticates separately and verifies endpoint permissions. The harness documents evidence and remediation steps with both authenticated and unauthenticated test results.
Yes, enterprises performing authorized security testing use this harness to identify access-control gaps in custom APIs. It systematically tests endpoints to reveal improper authorization and data exposure vulnerabilities.
The best way to document IDOR vulnerability evidence is by capturing both authenticated and unauthenticated test results. The harness systematically records evidence and remediation steps for discovered access control weaknesses.
Yes, you need two distinct test accounts to run the IDOR harness. This two-account setup allows you to verify access controls by testing whether one account can improperly access user-specific data belonging to the other.
cuongnguyen-gitVerify broken access control and IDOR with cross-account read, delete, and modify tests.
ricardoo022Test authenticated web apps for IDOR and privilege escalation vulnerabilities.
giosuetedeschi-specFuzz REST, SOAP, and GraphQL APIs to detect IDOR, injection, and authentication bypasses.
gaebalaiAudit API authorization designs for missing checks and privilege escalation risks.
