IDOR & Broken Object Level Auth (offensive-idor)

Authorization & Scope Notice: This skill is part of the REA_Skill + claude-red Unified Security & Reverse Engineering Suite. It is designed strictly for authorized security assessments, defensive architecture reviews, vulnerability triage, bug bounty verification, and remediation engineering on software, infrastructure, and assets you own or have explicit permission to test.

Overview

Insecure Direct Object Reference (IDOR) and Broken Object Level Authorization (BOLA) assessment covering sequential/UUID identifier predictability, horizontal and vertical privilege matrix testing, multi-tenant isolation, and Row-Level Security (RLS) policy verification. Use when auditing REST/GraphQL resource endpoints.

Operational Workflow