idor-harness

Test API endpoints with two accounts to detect IDOR vulnerabilities.

Updated Aug 23, 2026

Search Tags:#authorization #vulnerability #api-testing #access-control #security-testing #idor #bug-bounty

Ready to run

npx skills add https://github.com/AshtonVaughan/bountyhound --skill idor-harness

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: idor-harness
Source: https://github.com/AshtonVaughan/bountyhound/tree/main/bountyhound/skills/idor-harness
Command: npx skills add https://github.com/AshtonVaughan/bountyhound --skill idor-harness

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Systematic IDOR testing identifies authorization weaknesses by simulating multi-account scenarios to reveal improper access control and data exposure.

Core Features & Use Cases

Two-test-account authorization testing for IDOR scenarios across endpoints.
Automated harness to enumerate and validate user-specific data exposure and horizontal/vertical privilege escalations.
Use Case: enterprises performing authorized security testing to identify access-control gaps in custom APIs.

Quick Start

Set up two distinct test accounts and run the automated harness against a target to identify IDOR vulnerabilities.

Frequently Asked Questions about idor-harness

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for IDOR vulnerabilities across APIs?▼

IDOR testing identifies authorization weaknesses by simulating multi-account scenarios. You set up two distinct test accounts and run an automated harness against target endpoints to detect improper access control and data exposure.

What is the difference between horizontal and vertical IDOR in access control testing?▼

Horizontal IDOR involves accessing data of peer-level users, while vertical IDOR involves privilege escalation to higher roles. The two-account harness enumerates and validates both types of user-specific data exposure across multiple API surfaces.

How do I detect API access control gaps using two test accounts?▼

API access control gaps are detected by applying a two-account harness that authenticates separately and verifies endpoint permissions. The harness documents evidence and remediation steps with both authenticated and unauthenticated test results.

Can I use this IDOR harness for enterprise security testing?▼

Yes, enterprises performing authorized security testing use this harness to identify access-control gaps in custom APIs. It systematically tests endpoints to reveal improper authorization and data exposure vulnerabilities.

What is the best way to document IDOR vulnerability evidence for bug bounty reports?▼

The best way to document IDOR vulnerability evidence is by capturing both authenticated and unauthenticated test results. The harness systematically records evidence and remediation steps for discovered access control weaknesses.

Do I need two separate accounts to run IDOR security testing?▼

Yes, you need two distinct test accounts to run the IDOR harness. This two-account setup allows you to verify access controls by testing whether one account can improperly access user-specific data belonging to the other.