Test IDOR vulnerabilities across two user accounts using curl-based checks.
npx skills add https://github.com/woohyun212/security-skill --skill web-vuln-idor
Please help me install this Agent Skill. Skill: web-vuln-idor Source: https://github.com/woohyun212/security-skill/tree/main/web-vuln-idor Command: npx skills add https://github.com/woohyun212/security-skill --skill web-vuln-idor
IDOR vulnerabilities allow attackers to access or modify resources belonging to other users by manipulating object identifiers, leading to data leaks, account takeover, and privilege escalation.
Ask the AI to run the web‑vuln‑idor skill against the target URL with the required tokens to discover IDOR weaknesses.
High-intent search queries and answers about installing and using this skill.
IDOR detection uses two user accounts, requiring attacker and victim authentication tokens alongside a victim resource identifier. It executes automated curl-based checks to verify unauthorized access across realistic scenarios and multiple web vectors.
IDOR testing automates checks for mass assignment flaws, parameter pollution, and encoded IDs. By using attacker and victim tokens, it verifies unauthorized access and modification across realistic scenarios.
Running an IDOR vulnerability scan requires attacker and victim authentication tokens, a target base URL, and a victim resource identifier. These inputs enable automated curl-based checks across API and WebSocket vectors.
IDOR testing checks API version downgrade weaknesses by sending automated curl requests to older API version endpoints. It verifies whether downgraded endpoints expose insecure direct object references allowing unauthorized resource access.
IDOR vulnerability testing works with GraphQL node queries by manipulating object identifiers within the query payload. It compares attacker and victim token responses to identify unauthorized access to GraphQL nodes.
riandeoliveiraReplay authenticated REST and GraphQL requests with swapped object identifiers to detect BOLA and IDOR exposure.
wangdongzuopinAnalyze CVEs and CVSS scores to determine vulnerability severity and remediation.
NickCrewIdentify OWASP Top 10 security vulnerabilities in web applications.
AcczdyAutomate web application penetration testing following the OWASP WSTG with Burp Suite.
