web-vuln-idor

What this skill does

Detects Insecure Direct Object Reference (IDOR) vulnerabilities across 8 variant classifications (V1–V8), covering numeric IDs, UUID-based references, indirect parameters, GraphQL node() queries, WebSocket messages, file path references, API version downgrades, and mass assignment. Provides systematic two-account testing, impact classification, and chain escalation paths from IDOR to PII leak, ATO, and privilege escalation.

When to use

• When an endpoint URL or request body contains an ID parameter (numeric, UUID, base64, or encoded)
• When testing access control between two user accounts of the same or different roles
• When an API version endpoint exists alongside a newer one
• When GraphQL introspection reveals a node() query
• When a WebSocket message contains a client-supplied user or resource identifier
• When a file download endpoint includes a filename or path in the request

Prerequisites

• Two valid accounts on the target: Account A (attacker) and Account B (victim)
• A proxy tool (Burp Suite or Caido) configured to intercept requests
• Both accounts must have performed at least one action that creates a resource (order, report, profile, message)
• Authorization to test the target under a valid bug bounty or pentest scope

Inputs

Variable	Required	Description
SECSKILL_TARGET	Yes	Base URL of the target (e.g., https://app.example.com)
SECSKILL_TOKEN_A	Yes	Bearer token or session cookie for Account A (attacker)
SECSKILL_TOKEN_B	Yes	Bearer token or session cookie for Account B (victim)
SECSKILL_RESOURCE_ID	Yes	A resource ID owned by Account B (order_id, user_id, report_id, etc.)
SECSKILL_ENDPOINT	Yes	Endpoint containing the object reference (e.g., /api/orders/)
SECSKILL_OUTPUT_DIR	Optional	Directory to save results (default: ./output)

Workflow

Step 1: Environment setup and variant identification

export TARGET="${SECSKILL_TARGET}"
export TOKEN_A="${SECSKILL_TOKEN_A}"
export TOKEN_B="${SECSKILL_TOKEN_B}"
export VICTIM_ID="${SECSKILL_RESOURCE_ID}"
export ENDPOINT="${SECSKILL_ENDPOINT}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
mkdir -p "$OUTDIR"

# Classify the ID format — determines which variants to test
if echo "$VICTIM_ID" | grep -qE '^[0-9]+$'; then
  echo "[*] Numeric ID detected -> V1 (direct swap), V7 (API version), V8 (mass assignment)"
elif echo "$VICTIM_ID" | grep -qE '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'; then
  echo "[*] UUID detected -> V2 (need leak source), V3 (parameter pollution), V8 (mass assignment)"
elif echo "$VICTIM_ID" | grep -qE '^[A-Za-z0-9+/=]{20,}$'; then
  echo "[*] Base64/encoded ID detected -> V2 (decode and swap)"
  echo "$VICTIM_ID" | base64 -d 2>/dev/null && echo ""
fi

# Confirm Account A cannot legitimately access Account B's resource
echo "[*] Baseline: Account A's own resource access"
curl -sk -H "Authorization: Bearer $TOKEN_A" \
  "${TARGET}${ENDPOINT}" -w "\nHTTP: %{http_code}\n" | tail -3

echo "[*] Baseline: Account B owns the target resource (verify 200)"
curl -sk -H "Authorization: Bearer $TOKEN_B" \
  "${TARGET}${ENDPOINT}${VICTIM_ID}" -w "\nHTTP: %{http_code}\n" | tail -3