What problem does it solve? Finding Insecure Direct Object Reference (IDOR/BOLA) vulnerabilities requires proving that one principal can read or mutate another principal's objects, which demands disciplined controlled testing rather than ID guessing or brute-force enumeration. ## Core Features & Use Cases - Two-Principal Test Ledger: Structures testing around controlled accounts A and B with recorded tokens, tenants, object IDs, and parent IDs so every cross-object claim has causal evidence. - Concrete Test Recipes: Provides ready patterns for horizontal reads, nested/renderer ID swaps, GraphQL global-ID swaps, state-changing mutations, and search oracles across REST and GraphQL endpoints. - Negative-Control Stop Conditions: Applies a 12-category taxonomy (expected behavior, out-of-scope asset, duplicate root cause, prohibited test method, and more) so non-reportable findings are never filed. - Use Case: While testing a bug-bounty target, you notice /reports/{id} accepts numeric IDs. Use this Skill to build an A/B account ledger, swap B's report ID into A's authenticated request, verify B's canary data appears, and check the stop conditions before drafting a report. ## Quick Start Ask the agent to test the target's object-reference endpoints for IDOR using two controlled accounts and the idor-hunter recipes.
