How do I install the IDOR Vulnerability Testing skill?

Run npx skillmds@latest add dokhacgiakhoa/idor-vulnerability-testing in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is IDOR Vulnerability Testing safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with IDOR Vulnerability Testing?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is IDOR Vulnerability Testing free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published IDOR Vulnerability Testing?

Dokhacgiakhoa (@dokhacgiakhoa) published this skill. Their other Agent Skills are listed on their SkillMD profile.

IDOR Vulnerability Testing by dokhacgiakhoa

Name: IDOR Vulnerability Testing
Rating: 4.2 (5 reviews)
Author: Dokhacgiakhoa

IDOR Vulnerability Testing

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.

Dokhacgiakhoa Updated Aug 19, 2026 505 repo stars

File contents

IDOR Vulnerability Testing

Purpose

Provide systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. This skill covers both database object references and static file references, detection techniques using parameter manipulation and enumeration, exploitation via Burp Suite, and remediation strategies for securing applications against unauthorized access.

Inputs / Prerequisites

Target Web Application: URL of application with user-specific resources
Multiple User Accounts: At least two test accounts to verify cross-user access
Burp Suite or Proxy Tool: Intercepting proxy for request manipulation
Authorization: Written permission for security testing
Understanding of Application Flow: Knowledge of how objects are referenced (IDs, filenames)

Outputs / Deliverables

IDOR Vulnerability Report: Documentation of discovered access control bypasses
Proof of Concept: Evidence of unauthorized data access across user contexts
Affected Endpoints: List of vulnerable API endpoints and parameters
Impact Assessment: Classification of data exposure severity
Remediation Recommendations: Specific fixes for identified vulnerabilities

Core Workflow

🧠 Knowledge Modules (Fractal Skills)

1. 1. Understand IDOR Vulnerability Types

2. 2. Reconnaissance and Setup

3. 3. Detection Techniques

4. 4. Exploitation with Burp Suite

5. 5. Common IDOR Locations

6. IDOR Testing Checklist

7. Response Analysis

8. Common Vulnerable Parameters

9. Operational Boundaries

10. Detection Challenges

11. Legal Requirements

12. Example 1: Basic ID Parameter IDOR

13. Example 2: IDOR in Address Update Endpoint

14. Example 3: Static File IDOR

15. Example 4: Burp Intruder Enumeration

16. Example 5: Horizontal to Vertical Escalation

17. Issue: All Requests Return 403 Forbidden

18. Issue: Application Uses UUIDs Instead of Sequential IDs

19. Issue: Session Token Bound to User

20. Issue: Rate Limiting Blocks Enumeration

21. Issue: Cannot Verify IDOR Impact

22. Implement Proper Access Control

23. Use Indirect References

24. Server-Side Validation

---name: idor-vulnerability-testingdescription: This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.---# IDOR Vulnerability Testing## PurposeProvide systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. This skill covers both database object references and static file references, detection techniques using parameter manipulation and enumeration, exploitation via Burp Suite, and remediation strategies for securing applications against unauthorized access.## Inputs / Prerequisites- **Target Web Application**: URL of application with user-specific resources- **Multiple User Accounts**: At least two test accounts to verify cross-user access- **Burp Suite or Proxy Tool**: Intercepting proxy for request manipulation- **Authorization**: Written permission for security testing- **Understanding of Application Flow**: Knowledge of how objects are referenced (IDs, filenames)## Outputs / Deliverables- **IDOR Vulnerability Report**: Documentation of discovered access control bypasses- **Proof of Concept**: Evidence of unauthorized data access across user contexts- **Affected Endpoints**: List of vulnerable API endpoints and parameters- **Impact Assessment**: Classification of data exposure severity- **Remediation Recommendations**: Specific fixes for identified vulnerabilities## Core Workflow## 🧠 Knowledge Modules (Fractal Skills)### 1. [1. Understand IDOR Vulnerability Types](./sub-skills/1-understand-idor-vulnerability-types.md)### 2. [2. Reconnaissance and Setup](./sub-skills/2-reconnaissance-and-setup.md)### 3. [3. Detection Techniques](./sub-skills/3-detection-techniques.md)### 4. [4. Exploitation with Burp Suite](./sub-skills/4-exploitation-with-burp-suite.md)### 5. [5. Common IDOR Locations](./sub-skills/5-common-idor-locations.md)### 6. [IDOR Testing Checklist](./sub-skills/idor-testing-checklist.md)### 7. [Response Analysis](./sub-skills/response-analysis.md)### 8. [Common Vulnerable Parameters](./sub-skills/common-vulnerable-parameters.md)### 9. [Operational Boundaries](./sub-skills/operational-boundaries.md)### 10. [Detection Challenges](./sub-skills/detection-challenges.md)### 11. [Legal Requirements](./sub-skills/legal-requirements.md)### 12. [Example 1: Basic ID Parameter IDOR](./sub-skills/example-1-basic-id-parameter-idor.md)### 13. [Example 2: IDOR in Address Update Endpoint](./sub-skills/example-2-idor-in-address-update-endpoint.md)### 14. [Example 3: Static File IDOR](./sub-skills/example-3-static-file-idor.md)### 15. [Example 4: Burp Intruder Enumeration](./sub-skills/example-4-burp-intruder-enumeration.md)### 16. [Example 5: Horizontal to Vertical Escalation](./sub-skills/example-5-horizontal-to-vertical-escalation.md)### 17. [Issue: All Requests Return 403 Forbidden](./sub-skills/issue-all-requests-return-403-forbidden.md)### 18. [Issue: Application Uses UUIDs Instead of Sequential IDs](./sub-skills/issue-application-uses-uuids-instead-of-sequential-ids.md)### 19. [Issue: Session Token Bound to User](./sub-skills/issue-session-token-bound-to-user.md)### 20. [Issue: Rate Limiting Blocks Enumeration](./sub-skills/issue-rate-limiting-blocks-enumeration.md)### 21. [Issue: Cannot Verify IDOR Impact](./sub-skills/issue-cannot-verify-idor-impact.md)### 22. [Implement Proper Access Control](./sub-skills/implement-proper-access-control.md)### 23. [Use Indirect References](./sub-skills/use-indirect-references.md)### 24. [Server-Side Validation](./sub-skills/server-side-validation.md)

Frequently asked questions

IDOR Vulnerability Testing

File contents

IDOR Vulnerability Testing

Purpose

Inputs / Prerequisites

Outputs / Deliverables

Core Workflow

🧠 Knowledge Modules (Fractal Skills)

1. 1. Understand IDOR Vulnerability Types

2. 2. Reconnaissance and Setup

3. 3. Detection Techniques

4. 4. Exploitation with Burp Suite

5. 5. Common IDOR Locations

6. IDOR Testing Checklist

7. Response Analysis

8. Common Vulnerable Parameters

9. Operational Boundaries

10. Detection Challenges

11. Legal Requirements

12. Example 1: Basic ID Parameter IDOR

13. Example 2: IDOR in Address Update Endpoint

14. Example 3: Static File IDOR

15. Example 4: Burp Intruder Enumeration

16. Example 5: Horizontal to Vertical Escalation

17. Issue: All Requests Return 403 Forbidden

18. Issue: Application Uses UUIDs Instead of Sequential IDs

19. Issue: Session Token Bound to User

20. Issue: Rate Limiting Blocks Enumeration

21. Issue: Cannot Verify IDOR Impact

22. Implement Proper Access Control

23. Use Indirect References

24. Server-Side Validation

Related skills

Frequently asked questions

How do I install the IDOR Vulnerability Testing skill?

What does the IDOR Vulnerability Testing skill do?

Is IDOR Vulnerability Testing safe to use?

Which AI agents work with IDOR Vulnerability Testing?

Is IDOR Vulnerability Testing free to use?

Who published IDOR Vulnerability Testing?