idor-tester

To test for IDOR across two user accounts, you need two active authenticated sessions for the same environment. The skill executes cross-account read, delete, and modify tests against target endpoints to verify broken access control using reproducible evidence.

Broken access control testing verifies if one authenticated user can access another user's private resources. It confirms IDOR by requiring reproducible evidence, checking response statuses like 200/201/204, and verifying that returned or affected data belongs to the victim account.

You systematically verify cross-account IDOR by running targeted tests after hypothesis generation. The process uses the victim session to enumerate resource IDs, attempts cross-account operations, and checks response statuses alongside data ownership to confirm vulnerabilities.

Yes, you can use this for bug bounty reconnaissance and reproducibility. It requires two active sessions for the same scope and environment, performs consistent access control tests, and writes confirmed findings into structured notes for downstream triage preparation.

Before starting cross-account IDOR testing, you need a set of target endpoints or resources and two active authenticated user sessions for the same scope and environment. The workflow confirms both sessions are active before attempting any operations.

Confirmed IDOR findings are documented by writing them into a structured notes format for downstream triage. The workflow also logs weak or protected attempts into a knowledge base, ensuring all reproducible evidence is organized for bug bounty reporting.