hunt-idor
starsforks
How to install hunt-idor?
elementalsouls/claude-bughunter/hunt-idor
$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-idorHunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.
SKILL.md
| 1 | ## Crown Jewel Targets |
| 2 | |
| 3 | **Why IDOR pays big:** |
| 4 | - Direct access to other users' data without authentication bypass — clear, demonstrable impact |
| 5 | - Chains easily with privilege escalation, financial fraud, and account takeover |
| 6 | - Affects virtually every application with user-owned resources |
| 7 | |
| 8 | **Highest-value asset types (by payout potential):** |
| 9 | |
| 10 | | Asset Type | Why It Pays | |
| 11 | |---|---| |
| 12 | | Financial documents / billing APIs | PII + financial data exposure (Shopify, Uber, PayPal) | |
| 13 | | Private repositories / source code | IP theft, critical data loss (GitHub) | |
| 14 | | User messages / DMs | Privacy violation at scale (Reddit) | |
| 15 | | Account management endpoints | User addition, deletion, privilege escalation (PayPal, Mozilla) | |
| 16 | | Business/org administration | Cross-tenant escalation, employee PII (Uber) | |
| 17 | | Content moderation/admin actions | Operational sabotage (Reddit mod logs) | |
| 18 | |
| 19 | **Programs that pay most for IDOR:** |
| 20 | - Platforms with multi-tenancy (SaaS, B2B tools) |
| 21 | - Fintech and payment processors |
| 22 | - Social platforms with private content |
| 23 | - Developer tools with org/repo isolation |
| 24 | |
| 25 | --- |
| 26 | |
| 27 | ## Attack Surface Signals |
| 28 | |
| 29 | **URL patterns that scream IDOR:** |
| 30 | ``` |
| 31 | /api/v1/users/{id}/ |
| 32 | /api/v*/orders/{order_id} |
| 33 | /invoices/download?id= |
| 34 | /reports/{uuid}/ |
| 35 | /messages/{thread_id} |
| 36 | /admin/orgs/{org_id}/members |
| 37 | /migration/{migration_id}/files |
| 38 | /graphql (query params with IDs) |
| 39 | /api/business/{business_id}/ |
| 40 | /vouchers/{voucher_id}/policy |
| 41 | ``` |
| 42 | |
| 43 | **Response header signals:** |
| 44 | - `Content-Type: application/json` on endpoints accepting raw IDs |
| 45 | - No `X-Frame-Options` or CORS misconfigs paired with ID params |
| 46 | - `Authorization: Bearer` tokens that are user-scoped but hit org-level resources |
| 47 | |
| 48 | **JavaScript source patterns:** |
| 49 | ```javascript |
| 50 | // Look for hardcoded or interpolated IDs in JS |
| 51 | fetch(`/api/v1/users/${userId}/profile`) |
| 52 | axios.get('/invoices/' + invoiceId) |
| 53 | graphql query { billingDocument(id: $docId) } |
| 54 | // Redux/state stores exposing foreign IDs |
| 55 | state.currentUser.organizationId |
| 56 | ``` |
| 57 | |
| 58 | **Tech stack signals:** |
| 59 | - GraphQL endpoints (query-based IDORs are often missed) |
| 60 | - REST APIs with sequential integer IDs (most vulnerable) |
| 61 | - UUIDs that are predictable or leaked in other responses |
| 62 | - Multi-tenant SaaS apps with `org_id`, `account_id`, `business_id` params |
| 63 | - Mobile apps (Burp the APK — mobile APIs often skip authorization checks) |
| 64 | |
| 65 | --- |
| 66 | |
| 67 | ## Step-by-Step Hunting Methodology |
| 68 | |
| 69 | 1. **Map all object references in the application** |
| 70 | - Browse every feature authenticated as User A |
| 71 | - Capture all requests in Burp Suite |
| 72 | - Filter for requests containing: `id=`, `_id=`, `uuid=`, `/v1/{noun}/{id}`, query params with numeric/UUID values |
| 73 | |
| 74 | 2. **Enumerate ID types** |
| 75 | - Sequential integers → enumerate ±1, ±100 |
| 76 | - UUIDs → check if they appear in other responses or JS files |
| 77 | - Hashed IDs → check if leaked in public endpoints, metadata, or GraphQL introspection |
| 78 | |
| 79 | 3. **Create two separate accounts (same privilege level)** |
| 80 | - User A: resource owner |
| 81 | - User B: attacker account |
| 82 | - Log all IDs belonging to User A while authenticated as User A |
| 83 | |
| 84 | 4. **Replay User A's resource IDs as User B** |
| 85 | - Replace session cookie/token with User B's credentials |
| 86 | - Send identical requests referencing User A's object IDs |
| 87 | - Test ALL HTTP verbs: GET, POST, PUT, PATCH, DELETE on each endpoint |
| 88 | |
| 89 | 5. **Test cross-tenant/cross-org scenarios** |
| 90 | - Create accounts in separate organizations/businesses |
| 91 | - Test if Org B's session can reference Org A's IDs |
| 92 | - Pay special attention to admin/management endpoints |
| 93 | |
| 94 | 6. **Test GraphQL specifically** |
| 95 | - Run introspection: `{ __schema { queryType { fields { name } } } }` |
| 96 | - For every query/mutation taking an `id` argument, substitute another user's ID |
| 97 | - Test both queries (read) and mutations (write/delete) |
| 98 | |
| 99 | 7. **Test write/destructive operations, not just reads** |
| 100 | - Can User B DELETE User A's resources? |
| 101 | - Can User B MODIFY User A's content? |
| 102 | - Can User B ADD themselves to User A's account? |
| 103 | |
| 104 | 8. **Chain IDORs together** |
| 105 | - Use one IDOR's leaked data (org IDs, user IDs) to fuel the next |
| 106 | - IDOR → leaked ID → second IDOR → privilege escalation |
| 107 | |
| 108 | 9. **Test state-changing edge cases** |
| 109 | - Expired tokens/invites that can still be accepted |
| 110 | - Race conditions on resource IDs |
| 111 | - Indirect references: `?sort=id` or `?filter[user_id]=` |
| 112 | |
| 113 | 10. **Document the exact differential** |
| 114 | - Confirm User B has NO legitimate access to User A's resource |
| 115 | - Screenshot/log the 200 OK vs expected 403/404 |
| 116 | |
| 117 | --- |
| 118 | |
| 119 | ## Payload & Detection Patterns |
| 120 | |
| 121 | **Basic IDOR test with curl (swap cookie/token):** |
| 122 | ```bash |
| 123 | # Get User A's resource ID while authenticated as A |
| 124 | curl -s -H "Cookie: session=USER_A_SESSION" \ |
| 125 | https://target.com/api/v1/invoices/12345 |
| 126 | |
| 127 | # Replay with User B's session |
| 128 | curl -s -H "Cookie: session=USER_B_SESSION" \ |
| 129 | https://target.com/api/v1/invoices/12345 |
| 130 | |
| 131 | # Succ |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
