idor-testing
Provides techniques to detect and exploit IDOR vulnerabilities by testing access controls on direct object references.
Install
mkdir -p .claude/skills/idor-testing && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/2583" && unzip -o skill.zip -d .claude/skills/idor-testing && rm skill.zipInstalls to .claude/skills/idor-testing
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
IDOR不安全的直接对象引用测试的专业技能和方法论Key capabilities
- →Identify direct object references in parameters
- →Test horizontal and vertical authorization
- →Enumerate IDs for access flaws
- →Verify resource ownership validation
- →Test for directory traversal
How it works
It systematically manipulates object identifiers in requests to determine if the server fails to verify user authorization for the requested resource.
Inputs & outputs
When to use idor-testing
- →Testing horizontal authorization
- →Enumerating IDs for access flaws
- →Verifying vertical permission boundaries
About idor-testing
Guides the testing process for IDOR vulnerabilities, including identifier enumeration and permission checks. It helps verify if resources are protected from unauthorized access via manipulated object IDs.
IDOR不安全的直接对象引用测试的专业技能和方法论
When not to use it
- →Testing without explicit authorization
Limitations
- →Requires authorization to test the target
- →Testing can trigger security alerts
How it compares
It provides a structured methodology for testing access control, whereas manual testing is often ad-hoc and incomplete.
Compared to similar skills
idor-testing side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| idor-testing (this skill) | 2 | 6mo | Review | Advanced |
| security-requirement-extraction | 7 | 2mo | No flags | Intermediate |
| api-fuzzing-for-bug-bounty | 9 | 6mo | Review | Advanced |
| secure-workflow-guide | 3 | 2mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by Ed1s0nZ
View all by Ed1s0nZ →You might also like
security-requirement-extraction
wshobson
Derive security requirements from threat models and business context. Use when translating threats into actionable requirements, creating security user stories, or building security test cases.
api-fuzzing-for-bug-bounty
davila7
This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
secure-workflow-guide
trailofbits
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
cross-site-scripting-and-html-injection-testing
davila7
This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
defense-in-depth-validation
mrgoonie
Validate at every layer data passes through to make bugs impossible
semgrep-rule-creator
trailofbits
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.