Identify and exploit Insecure Direct Object References in web applications and APIs.
npx skills add https://github.com/SnailSploit/Claude-Red --skill idor-snailsploit
Please help me install this Agent Skill. Skill: idor Source: https://github.com/SnailSploit/Claude-Red/tree/main/Skills/offensive-idor Command: npx skills add https://github.com/SnailSploit/Claude-Red --skill idor-snailsploit
This Skill helps security professionals identify and exploit Insecure Direct Object Reference (IDOR) vulnerabilities, a common flaw that allows unauthorized access to data.
Use the idor skill to test the endpoint '/api/users/{id}/profile' for Insecure Direct Object References.
High-intent search queries and answers about installing and using this skill.
To test for IDOR vulnerabilities, you systematically manipulate object reference parameters in web application endpoints and APIs to detect unauthorized data access. The process involves blind detection, mass testing, and analyzing access control flaws across various request endpoints.
An Insecure Direct Object Reference (IDOR) is an access control flaw where parameter manipulation allows unauthorized access to data. Attackers alter object references in web application URLs or API parameters to view or modify records belonging to other users.
Yes, you can bypass obfuscated IDs and access controls by applying specific strategies to circumvent protections. Techniques include manipulating obfuscated identifiers and exploiting access control flaws to reveal hidden object references and gain unauthorized entry.
IDOR exploitation works with GraphQL, gRPC, and cloud-native object URLs by targeting access control flaws across these protocols. It identifies unauthorized object references and parameter manipulation vectors specific to each architectural endpoint type.
The best way to discover blind IDOR vulnerabilities is through systematic mass testing and parameter manipulation. This approach detects access control flaws by analyzing application responses to unauthorized object reference requests without direct visual confirmation.
hardw00tTests API security vulnerabilities across REST, GraphQL, gRPC, and WebSocket interfaces.
ArianHobson333Identify IDOR vulnerabilities that enable privilege escalation in web applications.
zebbernAutomate Burp Suite web application security testing across intercept, modify, scan, and manual workflows.
vitoropereiraDetect stored, reflected, and DOM-based XSS and HTML injection vulnerabilities in web applications.
