web-vuln-idor

What this skill does

Detects Insecure Direct Object Reference (IDOR) vulnerabilities across 8 variant classifications (V1–V8), covering numeric IDs, UUID-based references, indirect parameters, GraphQL node() queries, WebSocket messages, file path references, API version downgrades, and mass assignment. Provides systematic two-account testing, impact classification, and chain escalation paths from IDOR to PII leak, ATO, and privilege escalation.

When to use

• When an endpoint URL or request body contains an ID parameter (numeric, UUID, base64, or encoded)
• When testing access control between two user accounts of the same or different roles
• When an API version endpoint exists alongside a newer one
• When GraphQL introspection reveals a node() query
• When a WebSocket message contains a client-supplied user or resource identifier
• When a file download endpoint includes a filename or path in the request

Prerequisites

• Two valid accounts on the target: Account A (attacker) and Account B (victim)
• A proxy tool (Burp Suite or Caido) configured to intercept requests
• Both accounts must have performed at least one action that creates a resource (order, report, profile, message)
• Authorization to test the target under a valid bug bounty or pentest scope