idor-methodology

What problem does it solve?

IDOR vulnerabilities allow attackers to access or modify data of other users by manipulating identifiers such as user_id, account numbers, or file names without proper authorization checks. This Skill provides a structured methodology to detect, verify, and reason about insecure direct object references across APIs and web applications, including horizontal and vertical privilege escalation, multi-step chains, file/resource access, and indirect references.

Core Features & Use Cases

• Systematic discovery across URL paths, query parameters, request bodies, and indirect identifiers (e.g., GraphQL variables, API responses).
• Coverage of bypass techniques (parameter pollution, encoding, method switching) and multi-step attack chains for real-world scenarios.
• Evidence-driven testing with PoCs, scalable reconnaissance scripts, and guidance for validating write/modify operations.

Quick Start

Provide an IDOR test plan for a target API and run the methodology to enumerate identifiers and verify access controls.