skills.rest
anonymous99-Rise
anonymous99-RiseCOMMUNITY
Explore all skills by this author →
𝕏@VqjIX47lUK5jgwkGitHub

idor-testing

Tests web applications and APIs for IDOR and broken object-level authorization vulnerabilities.

1|Updated Jul 17, 2026
Search Tags:#authorization#multi-tenant#penetration testing#api security#idor#bola#uuid analysis
One-click install
npx skills add https://github.com/anonymous99-Rise/multi-CyberSecurity --skill idor-testing-anonymous99-rise
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: idor-testing
Source: https://github.com/anonymous99-Rise/multi-CyberSecurity/tree/main/Skills20260809/idor-testing
Command: npx skills add https://github.com/anonymous99-Rise/multi-CyberSecurity --skill idor-testing-anonymous99-rise

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Broken object-level authorization (IDOR/BOLA) is one of the most common and damaging API flaws, yet it is hard to detect with generic scanners because it requires comparing responses across users, roles, and tenants. This Skill provides a systematic methodology for finding horizontal/vertical privilege escalation, predictable identifier abuse, and cross-tenant isolation failures before attackers do. ## Core Features & Use Cases - Comprehensive IDOR attack surface coverage: Tests horizontal/vertical privilege escalation (BOLA/BFLA), mass assignment, prototype pollution, GraphQL node queries, WebSocket channel subscription, and JWT claim tampering across REST, GraphQL, and gRPC endpoints. - Predictable identifier reverse engineering: Decodes UUIDv1 timestamps, Snowflake IDs, ULIDs, Hashids, and Base62 short codes, plus entropy analysis to determine whether "random" IDs are actually enumerable. - Multi-tenant and AI platform testing: Covers cross-tenant isolation failures (X-Tenant-ID switching, JWT tenant claims, cache key leakage) and LLM platform object authorization (flows, threads, credentials, knowledge bases) with real CVE case studies. - Automated BOLA detection methodology: Multi-account session comparison using Autorize, AuthMatrix, and AutoRepeater with response body diffing rather than status-code-only checks. - Use Case: During an authorized API penetration test, configure two test accounts, replay all captured requests with the low-privilege session, and use the response-diffing checklist to identify endpoints leaking other users' order, invoice, or profile data. ## Quick Start Ask the AI to test the target application's user profile and order API endpoints for horizontal and vertical IDOR vulnerabilities using two authorized test accounts.

Frequently Asked Questions about idor-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for IDOR vulnerabilities in a REST API?▼

Create two test accounts, capture all requests containing object IDs with the first account, then replay them with the second account's session while replacing ID values. Compare response bodies, not just status codes, since many vulnerable endpoints return 200 with different data.

What tools automate BOLA and IDOR detection in Burp Suite?▼

Autorize replays requests with a low-privilege cookie and color-codes authorization failures, AuthMatrix tests role-based permission matrices, and AutoRepeater automatically replaces resource ID parameters. Combining all three covers most automated BOLA detection scenarios.

Can UUIDs be predicted or enumerated in IDOR attacks?▼

UUIDv4 is cryptographically random and not enumerable, but UUIDv1 embeds a timestamp and MAC address making it partially predictable. Snowflake IDs, ULIDs, and sequential UUIDs also leak creation time and ordering, enabling enumeration when authorization checks are missing.

How do I test multi-tenant SaaS applications for cross-tenant access?▼

Switch tenant identifiers in headers like X-Tenant-ID, path segments, subdomains, and JWT claims while using a token from a different tenant. Also check search indexes, export endpoints, and cache keys for missing tenant-scoping that leaks data across tenants.

Why does status-code-only IDOR detection miss vulnerabilities?▼

Many frameworks return uniform 200 or 403 responses regardless of authorization outcome, so the actual data leakage only appears in the response body. Reliable detection requires comparing body hashes, sensitive field presence, and array lengths between privileged and unprivileged sessions.

Is IDOR testing legal to perform on production systems?▼

IDOR testing is only legal within explicit written authorization such as a penetration testing contract or bug bounty scope. Accessing other users' real data without authorization violates laws like the Computer Fraud and Abuse Act, so testing should use dedicated test accounts.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

exploiting-mass-assignment-in-rest-apis

Detect and exploit mass assignment vulnerabilities in REST APIs by injecting unauthorized parameters.

Community
Intermediate
rabbicserabbicse

security-reviewer

Identify security vulnerabilities in code, dependencies, secrets, and infrastructure.

Community
Advanced
Prohao42Prohao42
120

api-auth-and-jwt-abuse

Identify security weaknesses in API authentication and JWT token handling.

Community
Advanced
devkenidevkeni
1

api-security

Identify and exploit misconfigurations and vulnerabilities across REST, GraphQL, gRPC, and WebSocket APIs.

Community
Advanced