idor-tester

What problem does it solve?

It helps you determine whether one authenticated user can access, modify, or delete another user's private resources (IDOR / broken access control), turning vague suspicions into reproducible evidence.

Core Features & Use Cases

• Two-account, cross-session testing workflow: Confirms both sessions are active and authenticated before attempting any cross-account operations.
• Targeted resource enumeration and ID collection: Uses the victim session to enumerate resource IDs to test.
• Read, delete, modify, and escalation checks: Performs consistent access control tests across common endpoint patterns and verifies ownership with the victim session.
• Finding documentation and triage prep: Writes confirmed findings into a structured notes format for downstream triage, plus logs weak/protected attempts into a knowledge base.

Quick Start

Run the idor-tester skill against your hypothesis folder path for a target where you have two active sessions and want to test whether A can access B's data.