Individual skill

exploiting-idor-vulnerabilities

Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (numeric IDs, UUIDs, slugs) in API requests and URLs, using Burp Suite proxy history, Intruder, and the Authorize extension to test object-level authorization across sessions. Use during authorized penetration tests or bug bounty work to validate that CRUD endpoints and multi-tenant applications enforce per-object access control.

skills/exploiting-idor-vulnerabilities/SKILL.md

Read pinned source

Source commit 54a798831d2266a3ca61ce68a7acb80b81160d57

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Network or broad shell
Last checked: Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 35,918
Repository last updated: Aug 31, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

ai-agents Repository topic
claude-code Repository topic
cybersecurity Repository topic
incident-response Repository topic
mitre-attack Repository topic
penetration-testing Repository topic
red-team Repository topic
security Repository topic
cloud-security Repository topic
malware-analysis Repository topic
penetration-testing Declared skill tag
idor Declared skill tag
access-control Declared skill tag
owasp Declared skill tag
burpsuite Declared skill tag
web-security Declared skill tag
testing Derived category
security Derived category
security-application Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

LICENSEasset · 11,255 bytes
SKILL.mdcore · 11,910 bytes
SKILL.mdcore · 11,910 bytes
SKILL.mdcore · 11,910 bytes
SKILL.mdcore · 11,910 bytes
SKILL.mdcore · 11,910 bytes
SKILL.mdcore · 11,910 bytes
references/api-reference.mddoc · 1,813 bytes
scripts/agent.pyruns · 7,390 bytes

Read excerpt


# Exploiting IDOR Vulnerabilities

## When to Use

- During authorized penetration tests when testing access control on resource endpoints
- When APIs or web pages use predictable identifiers (numeric IDs, UUIDs, slugs) in URLs or request bodies
- For validating that object-level authorization is enforced across all CRUD operations
- When testing multi-tenant applications where users should only access their own data
- During bug bounty programs targeting broken access control vulnerabilities

## Prerequisites

- **Authorization**: Written penetration testing agreement for the target application
- **Burp Suite Professional**: With Authorize extension installed from BApp Store