idor-testing

Identify and validate insecure direct object reference vulnerabilities in web applications and APIs.

Updated Jun 17, 2026

Search Tags:#vulnerability assessment #access control #web security #api testing #idor #burp suite

Ready to run

npx skills add https://github.com/JingyueCong/LatentRiskBench --skill idor-testing-jingyuecong

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: idor-testing
Source: https://github.com/JingyueCong/LatentRiskBench/tree/main/latentriskbench/agent/skills/idor-testing
Command: npx skills add https://github.com/JingyueCong/LatentRiskBench --skill idor-testing-jingyuecong

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security testers identify insecure direct object references and broken access control issues that allow unauthorized access to application resources.

Core Features & Use Cases

IDOR Detection Workflows: Systematically test object identifiers, parameters, file references, and API endpoints for authorization weaknesses.
Access Control Validation: Compare user contexts, analyze responses, and verify whether resources are properly restricted.
Use Case: A security engineer can use this Skill during an authorized web application assessment to document vulnerable endpoints, demonstrate impact, and recommend remediation steps.

Quick Start

Use the idor-testing skill to review an authorized web application for potential insecure direct object reference vulnerabilities.

Frequently Asked Questions about idor-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for IDOR vulnerabilities in web APIs?▼

To test for IDOR vulnerabilities in web APIs, systematically enumerate object identifiers and parameters, then analyze responses to verify if resources are properly restricted across different user contexts.

What is the best way to validate broken access control during an authorized security assessment?▼

The best way to validate broken access control is by comparing user contexts and analyzing endpoint responses to safely verify whether unauthorized resource access is permitted.

How do I enumerate objects and endpoints to find insecure direct object references?▼

You can find insecure direct object references by applying systematic testing procedures to enumerate file references, API endpoints, and object identifiers for authorization weaknesses.

Can I use this approach to generate remediation guidance for access control flaws?▼

Yes, this approach evaluates secure applications by documenting vulnerable endpoints, demonstrating impact, and recommending specific remediation steps for access control flaws.

Does IDOR testing require specific proxy tools like Burp Suite?▼

IDOR testing can involve tools like Burp Suite for intercepting API traffic, but the core process requires systematic authorization checks and response analysis to identify access control vulnerabilities.

When should I perform access control testing on web applications?▼

You should perform access control testing during authorized security assessments to safely identify insecure direct object references and verify that application resources are properly restricted.