offensive-idor

Name: offensive-idor
Author: SnailSploit

2.8kstars447forks

How to install offensive-idor?

snailsploit/claude-red/offensive-idor

$npx -y skills add SnailSploit/Claude-Red --skill offensive-idor

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Insecure Direct Object References (IDOR)
2
3	## Metadata
4	- Skill Name: idor
5	- Folder: offensive-idor
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/idor.md
7
8	## Description
9	IDOR (Insecure Direct Object Reference) testing checklist: object ID enumeration, horizontal/vertical privilege escalation, GUID predictability, indirect references via hashes, chained IDOR, and API endpoint IDOR. Use for web app pentests and bug bounty IDOR discovery.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`IDOR, insecure direct object reference, horizontal privilege escalation, vertical privilege escalation, object enumeration, GUID, API IDOR, mass assignment, broken access control`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Insecure Direct Object References (IDOR)
29
30	## Shortcut
31
32	```mermaid
33	flowchart LR
34	A[Create Test Accounts] --> B[Discover Features]
35	B --> C[Intercept Traffic]
36	C --> D[Switch IDs in Requests]
37	D --> E{IDOR Found?}
38	E -->\|Yes\| F[Document Vulnerability]
39	E -->\|No\| G[Try Protection Bypass]
40	G --> H[Monitor Information Leaks]
41	```
42
43	- Create two accounts for each application role and designate one as the attacker account and the other as the victim account.
44	- Discover features in the application that might lead to IDOR. Pay attention to features that return sensitive information or modify user data.
45	- Revisit the features you discovered in step 2. With a proxy, intercept your browser traffic while you browse through the sensitive functionalities.
46	- With a proxy, intercept each sensitive request and switch out the IDs that you see in the requests. If switching out IDs grants you access to other user's information or lets you change their data, this indicates an IDOR.
47	- Don't despair if the application seems to be immune to IDOR. Use this opportunity to try a protection bypass technique. If the application uses an encoded, hashed, or randomized ID, you can try decoding, or predicting the IDs. You can also try supplying the application with an ID when it does not ask for one. Finally, sometimes changing the request method type or file type makes all the difference.
48	- Monitor for information leaks in export files, email, and other text alerts. An IDOR now might lead to an information leak in the future.
49
50	## Mechanisms
51
52	```mermaid
53	flowchart TD
54	A[IDOR Vulnerabilities] --> B[Missing Authorization Checks]
55	A --> C[Client-Side ID Transmission]
56	A --> D[Predictable Resource Identifiers]
57	A --> E[Insufficient Access Control Logic]
58	A --> F[Improper Session Handling]
59	A --> G[Reliance on Obfuscation]
60
61	B --> H[Horizontal Access Control Failures]
62	C --> H
63	D --> I[Vertical Access Control Failures]
64	E --> I
65	F --> J[Context-Dependent Access Control Failures]
66	G --> J
67	```
68
69	Insecure Direct Object References (IDOR) occur when an application exposes a reference to an internal implementation object without sufficient access control. These vulnerabilities allow attackers to manipulate these references to access unauthorized data or perform unauthorized actions.
70
71	IDOR vulnerabilities arise from flawed access control mechanisms that fail to validate whether a user should have permission to access or modify a specific resource. The core implementation issues include:
72
73	- Missing Authorization Checks: No validation of user permissions when accessing objects
74	- Client-Side ID Transmission: Relying on client-provided identifiers without server-side verification
75	- Predictable Resource Identifiers: Sequential or easily guessable object references
76	- Insufficient Access Control Logic: Authentication without proper authorization
77	- Improper Session Handling: Not binding resources to user sessions
78	- Reliance on Obfuscation: Using complex identifiers without actual access control
79
80	IDORs manifest in various patterns:
81
82	- Horizontal Access Control Failures: Accessing resources belonging to other users of the same privilege level
83	- Vertical Access Control Failures: Accessing resources requiring higher privileges
84	- Context-Dependent Access Control Failures: Access based on improper contextual states
85
86	## Hunt
87
88	### Identifying IDOR Vulnerabilities
89
90	#### Preparation
91
92	1. Create Multiple Test Accounts:
93	- Set up accounts with different privilege levels (e.g., regular user, premium user)
94	- Create multiple accounts within the same privilege level
95
96	2. Establish Baseline Behavior:
97	- Document normal resource access patterns
98	- Map all application endpoints that reference objects
99	- Identify resource identifiers in requests
100	- Evaluate caching hea

People who liked this also viewed

6 picks

Type

offensive-idor

2.8kstars447forks

View on GitHub

How to install offensive-idor?

snailsploit/claude-red/offensive-idor

$npx -y skills add SnailSploit/Claude-Red --skill offensive-idor

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Insecure Direct Object References (IDOR)
2
3	## Metadata
4	- Skill Name: idor
5	- Folder: offensive-idor
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/idor.md
7
8	## Description
9	IDOR (Insecure Direct Object Reference) testing checklist: object ID enumeration, horizontal/vertical privilege escalation, GUID predictability, indirect references via hashes, chained IDOR, and API endpoint IDOR. Use for web app pentests and bug bounty IDOR discovery.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`IDOR, insecure direct object reference, horizontal privilege escalation, vertical privilege escalation, object enumeration, GUID, API IDOR, mass assignment, broken access control`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Insecure Direct Object References (IDOR)
29
30	## Shortcut
31
32	```mermaid
33	flowchart LR
34	A[Create Test Accounts] --> B[Discover Features]
35	B --> C[Intercept Traffic]
36	C --> D[Switch IDs in Requests]
37	D --> E{IDOR Found?}
38	E -->\|Yes\| F[Document Vulnerability]
39	E -->\|No\| G[Try Protection Bypass]
40	G --> H[Monitor Information Leaks]
41	```
42
43	- Create two accounts for each application role and designate one as the attacker account and the other as the victim account.
44	- Discover features in the application that might lead to IDOR. Pay attention to features that return sensitive information or modify user data.
45	- Revisit the features you discovered in step 2. With a proxy, intercept your browser traffic while you browse through the sensitive functionalities.
46	- With a proxy, intercept each sensitive request and switch out the IDs that you see in the requests. If switching out IDs grants you access to other user's information or lets you change their data, this indicates an IDOR.
47	- Don't despair if the application seems to be immune to IDOR. Use this opportunity to try a protection bypass technique. If the application uses an encoded, hashed, or randomized ID, you can try decoding, or predicting the IDs. You can also try supplying the application with an ID when it does not ask for one. Finally, sometimes changing the request method type or file type makes all the difference.
48	- Monitor for information leaks in export files, email, and other text alerts. An IDOR now might lead to an information leak in the future.
49
50	## Mechanisms
51
52	```mermaid
53	flowchart TD
54	A[IDOR Vulnerabilities] --> B[Missing Authorization Checks]
55	A --> C[Client-Side ID Transmission]
56	A --> D[Predictable Resource Identifiers]
57	A --> E[Insufficient Access Control Logic]
58	A --> F[Improper Session Handling]
59	A --> G[Reliance on Obfuscation]
60
61	B --> H[Horizontal Access Control Failures]
62	C --> H
63	D --> I[Vertical Access Control Failures]
64	E --> I
65	F --> J[Context-Dependent Access Control Failures]
66	G --> J
67	```
68
69	Insecure Direct Object References (IDOR) occur when an application exposes a reference to an internal implementation object without sufficient access control. These vulnerabilities allow attackers to manipulate these references to access unauthorized data or perform unauthorized actions.
70
71	IDOR vulnerabilities arise from flawed access control mechanisms that fail to validate whether a user should have permission to access or modify a specific resource. The core implementation issues include:
72
73	- Missing Authorization Checks: No validation of user permissions when accessing objects
74	- Client-Side ID Transmission: Relying on client-provided identifiers without server-side verification
75	- Predictable Resource Identifiers: Sequential or easily guessable object references
76	- Insufficient Access Control Logic: Authentication without proper authorization
77	- Improper Session Handling: Not binding resources to user sessions
78	- Reliance on Obfuscation: Using complex identifiers without actual access control
79
80	IDORs manifest in various patterns:
81
82	- Horizontal Access Control Failures: Accessing resources belonging to other users of the same privilege level
83	- Vertical Access Control Failures: Accessing resources requiring higher privileges
84	- Context-Dependent Access Control Failures: Access based on improper contextual states
85
86	## Hunt
87
88	### Identifying IDOR Vulnerabilities
89
90	#### Preparation
91
92	1. Create Multiple Test Accounts:
93	- Set up accounts with different privilege levels (e.g., regular user, premium user)
94	- Create multiple accounts within the same privilege level
95
96	2. Establish Baseline Behavior:
97	- Document normal resource access patterns
98	- Map all application endpoints that reference objects
99	- Identify resource identifiers in requests
100	- Evaluate caching hea

People who liked this also viewed

6 picks

Type