Agent skill · security · yaklang
idor-broken-object-authorization
IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.
Why this skill is useful
Provides a comprehensive playbook with specific attack methodologies and patterns for testing IDOR vulnerabilities that are not widely documented.
What it needs
About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: IDOR / Broken Object Level Authorization — Expert Attack Playbook AI LOAD INSTRUCTION: IDOR is the #1 bug bounty finding. This skill covers non-obvious IDOR surfaces, all attack vectors (not just URL params), A-B testing methodology, BOLA vs BFLA distinction, chaining IDOR to higher impact, and what testers repeatedly miss. --- 1. IDOR vs BOLA vs BFLA Term Meaning Impact --- --- --- IDOR Insecure Direct Object Reference Read/modify other users' data BOLA Broken Object Level Authorization (OWASP API Top 10 A1) Same as IDOR, API terminology BFLA Broken Function Level Authorization Low-priv user accesses HIGH-PRIV functions (e.g., admin endpoints) Key distinction: BOLA = accessing object you shouldn't own (data belonging to other users) BFLA = accessing function you shouldn't be authorized for (admin CRUD operations, bulk actions, user management) --- 2. WHERE TO FIND OBJECT IDs (ALL LOCATIONS) Don't stop at URL path parameters — IDs appear in: --- 3. A-B TESTING METHODOLOGY The most systematic IDOR test approach: --- 4. ID TYPE ITS IMPLICATIONS ID Pattern Example Notes --- --- --- Sequential int id=1001 → id=1002 Easy prediction, high hit rate UUID v4 550e8400-... Need to find UUID from other endpoints UUID v1 Clock-based UUID Time-predictable! Extract timestamp/MAC GUIDs from own data See in responses Collect all UUIDs from your own account data first Hashed IDs md5(userid) Try hashing sequential ints Encoded IDs base64({"id":1001}) Decode → modify → re-encode Compound IDs /api/users/1/orders/5 Both IDs may be independently verifiable --- 5. HORIZONTAL vs VERTICAL PRIVILEGE ESCALATION Horizontal: UserA accesses UserB's data (same privilege level) Vertical: Low-priv user accesses admin-only functions Combined: Low-priv IDOR that grants privilege escalation --- 6. HTTP METHOD ESCALATION When GET /resource/1234 is properly restricted, test ALL other verbs: Why this works: Authorization logic is often implemented per-method, and developers forget edge cases. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/idor-broken-object-authorization