How do I install the Web Auth Bypass Idor skill?

Run npx skillmds@latest add s0ld13rr/web-auth-bypass-idor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Auth Bypass Idor safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Auth Bypass Idor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Auth Bypass Idor free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Auth Bypass Idor?

s0ld13rr (@s0ld13rr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Auth Bypass Idor by s0ld13rr — Agent Skill

Name: Web Auth Bypass Idor
Rating: 4.5 (4 reviews)
Author: s0ld13rr

Web Auth Bypass Idor

Broken access control - IDOR, privilege escalation, JWT abuse, mass assignment, forced browsing - for web apps and APIs. Use on any multi-user or role-based app with object IDs, tokens, or admin functionality. Triggers - /api/users/<id>, /orders/<id>, ?account=/uid=/doc=, JWT (eyJ...), role/isAdmin field, admin panel, "403 Forbidden", numeric or guessable object references.

s0ld13rr Updated Sep 22, 2026

File contents

Broken Access Control (IDOR / privesc / JWT / mass-assignment)

When this fires

Any app with per-object endpoints, user roles, tokens, or admin functions — the most common (and highest-scoring) web bug class.

Decide — which sub-class

Object ID in URL/param/body → IDOR (swap it).
JWT / signed token → JWT abuse.
Object accepts fields you shouldn't set (role,isAdmin,is_verified) → mass assignment.
Admin path returns 403 to you → forced browsing / vertical privesc.

Detect → Exploit → PROVE IMPACT

IDOR:  authenticate as user A; hit A's /api/orders/1001 → change to 1002/other IDs (incl. UUIDs seen elsewhere,
       decremented, from another account). Also flip method (GET→PUT/DELETE) and try without auth.
       PROVE: read/modify ANOTHER user's data.
Mass assignment: add {"role":"admin","isAdmin":true,"userId":<victim>} to a profile/update/signup body.
       PROVE: your account gains a privilege the UI never grants.
Forced browsing / method: request admin endpoints directly; try X-Original-URL / X-Rewrite-URL / trailing
       /./ /%2e/ ; verb tampering (HEAD/OPTIONS); 403-bypass headers (X-Forwarded-For 127.0.0.1).
       PROVE: reach an admin function as a low-priv/anon user.

JWT (drive with jwt_analyze, then forge):

alg:none      → header {"alg":"none"}, drop signature, set {"admin":true}/{"role":"admin"}
weak HMAC     → crack the secret (hashcat -m 16500 <jwt> wordlist) → re-sign with the new claims
alg confusion → RS256→HS256 signing the token with the PUBLIC key as the HMAC secret
kid / jku / x5u → path-traversal/SSRF the key source to one you control

Proof required: access to another user's data, or a forged/tampered token that authenticates you as admin and reaches a privileged action.

Tooling

jwt_analyze for token analysis; Burp/ffuf to sweep object IDs; nuclei -tags idor,jwt,exposure.

False positives / pitfalls

Server re-checks ownership after the swap (returns 403/empty) → not IDOR; try other IDs/methods.
Random UUIDs with no leak → IDOR may need an ID-disclosure primitive first.
"alg:none" rejected by a patched lib → move to weak-secret / confusion / kid.

---name: web-auth-bypass-idordescription: Broken access control - IDOR, privilege escalation, JWT abuse, mass assignment, forced browsing - for web apps and APIs. Use on any multi-user or role-based app with object IDs, tokens, or admin functionality. Triggers - /api/users/<id>, /orders/<id>, ?account=/uid=/doc=, JWT (eyJ...), role/isAdmin field, admin panel, "403 Forbidden", numeric or guessable object references.---# Broken Access Control (IDOR / privesc / JWT / mass-assignment)## When this firesAny app with per-object endpoints, user roles, tokens, or admin functions — the most common (and highest-scoring) web bug class.## Decide — which sub-class- Object ID in URL/param/body → **IDOR** (swap it).- JWT / signed token → **JWT abuse**.- Object accepts fields you shouldn't set (`role`,`isAdmin`,`is_verified`) → **mass assignment**.- Admin path returns 403 to you → **forced browsing / vertical privesc**.## Detect → Exploit → PROVE IMPACT```IDOR: authenticate as user A; hit A's /api/orders/1001 → change to 1002/other IDs (incl. UUIDs seen elsewhere, decremented, from another account). Also flip method (GET→PUT/DELETE) and try without auth. PROVE: read/modify ANOTHER user's data.Mass assignment: add {"role":"admin","isAdmin":true,"userId":<victim>} to a profile/update/signup body. PROVE: your account gains a privilege the UI never grants.Forced browsing / method: request admin endpoints directly; try X-Original-URL / X-Rewrite-URL / trailing /./ /%2e/ ; verb tampering (HEAD/OPTIONS); 403-bypass headers (X-Forwarded-For 127.0.0.1). PROVE: reach an admin function as a low-priv/anon user.```JWT (drive with `jwt_analyze`, then forge):```alg:none → header {"alg":"none"}, drop signature, set {"admin":true}/{"role":"admin"}weak HMAC → crack the secret (hashcat -m 16500 <jwt> wordlist) → re-sign with the new claimsalg confusion → RS256→HS256 signing the token with the PUBLIC key as the HMAC secretkid / jku / x5u → path-traversal/SSRF the key source to one you control```**Proof required:** access to another user's data, or a forged/tampered token that authenticates you as admin and reaches a privileged action.## Tooling`jwt_analyze` for token analysis; Burp/ffuf to sweep object IDs; `nuclei -tags idor,jwt,exposure`.## False positives / pitfalls- Server re-checks ownership after the swap (returns 403/empty) → not IDOR; try other IDs/methods.- Random UUIDs with no leak → IDOR may need an ID-disclosure primitive first.- "alg:none" rejected by a patched lib → move to weak-secret / confusion / kid.

Frequently asked questions