How do I install the Offensive Idor skill?

Run npx skillmds@latest add owasp/offensive-idor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Offensive Idor safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Offensive Idor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Offensive Idor free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Offensive Idor?

OWASP (@owasp) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Offensive Idor by owasp — Agent Skill

Name: Offensive Idor
Author: OWASP

Offensive Idor

Insecure Direct Object Reference (IDOR) testing skill focused on Azure resource identifiers and API endpoints. Covers GUID enumeration, horizontal/vertical privilege escalation, and Azure-specific object reference vulnerabilities.

OWASP fe6ce50 2.4 KB Updated Sep 17, 2026

File contents

Insecure Direct Object References (IDOR) — Azure Offensive Methodology

When to Use

When testing Azure-hosted web applications and APIs that use resource identifiers (IDs, GUIDs) in requests.
When validating if users can access or modify resources belonging to other tenants or users.
When assessing the security of Azure Storage pre-signed URLs (SAS tokens) as object references.
When performing security audits of internal administrative portals that manage Azure resources.

Key Concepts

Term	Definition
Horizontal Escalation	Accessing resources of another user with the same privilege level
Vertical Escalation	Accessing resources that require a higher privilege level (e.g., admin)
BOLA	Broken Object Level Authorization, the API-specific term for IDOR
SAS Token	Azure Storage Shared Access Signature, often used as a direct object reference

Detection & Exploitation

API IDOR Discovery

Many Azure-integrated apps use GUIDs. While GUIDs are not sequential, they may be leaked in other API responses.

# Example: Accessing a profile by ID
GET /api/v1/users/a1b2c3d4-e5f6-7890-abcd-ef1234567890/settings

# Test: Replace with a victim's GUID found in a search or list endpoint
GET /api/v1/users/<victim-guid>/settings

Azure Storage SAS Token Manipulation

SAS tokens are often used to grant temporary access to blobs. If the token is not scoped correctly or has a long expiry, it acts as a vulnerable object reference.

# Test for scope: Can I access another blob in the same container?
https://mystorage.blob.core.windows.net/mycontainer/secret.txt?<sas-token>
# Change to:
https://mystorage.blob.core.windows.net/mycontainer/other_user_file.txt?<sas-token>

Remediation Reference

Check Ownership: Always verify on the server side that the authenticated user owns the object they are requesting.
Use UUIDs: While not a replacement for auth, using non-sequential UUIDs prevents basic enumeration.
Scope SAS Tokens: Always use the most restrictive permissions and shortest possible expiry for SAS tokens.

---name: offensive-idordescription: Insecure Direct Object Reference (IDOR) testing skill focused on Azure resource identifiers and API endpoints. Covers GUID enumeration, horizontal/vertical privilege escalation, and Azure-specific object reference vulnerabilities.license: Apache-2.0---# Insecure Direct Object References (IDOR) — Azure Offensive Methodology## When to Use- When testing Azure-hosted web applications and APIs that use resource identifiers (IDs, GUIDs) in requests.- When validating if users can access or modify resources belonging to other tenants or users.- When assessing the security of Azure Storage pre-signed URLs (SAS tokens) as object references.- When performing security audits of internal administrative portals that manage Azure resources.## Key Concepts| Term | Definition ||------|------------|| Horizontal Escalation | Accessing resources of another user with the same privilege level || Vertical Escalation | Accessing resources that require a higher privilege level (e.g., admin) || BOLA | Broken Object Level Authorization, the API-specific term for IDOR || SAS Token | Azure Storage Shared Access Signature, often used as a direct object reference |## Detection & Exploitation### API IDOR DiscoveryMany Azure-integrated apps use GUIDs. While GUIDs are not sequential, they may be leaked in other API responses.```bash# Example: Accessing a profile by IDGET /api/v1/users/a1b2c3d4-e5f6-7890-abcd-ef1234567890/settings# Test: Replace with a victim's GUID found in a search or list endpointGET /api/v1/users/<victim-guid>/settings```### Azure Storage SAS Token ManipulationSAS tokens are often used to grant temporary access to blobs. If the token is not scoped correctly or has a long expiry, it acts as a vulnerable object reference.```bash# Test for scope: Can I access another blob in the same container?https://mystorage.blob.core.windows.net/mycontainer/secret.txt?<sas-token># Change to:https://mystorage.blob.core.windows.net/mycontainer/other_user_file.txt?<sas-token>```## Remediation Reference- **Check Ownership**: Always verify on the server side that the authenticated user owns the object they are requesting.- **Use UUIDs**: While not a replacement for auth, using non-sequential UUIDs prevents basic enumeration.- **Scope SAS Tokens**: Always use the most restrictive permissions and shortest possible expiry for SAS tokens.

Frequently asked questions