Поиск и эксплуатация IDOR-уязвимостей

★ 6.6 · security

idor-testing is a Claude Code skill that provides a systematic methodology for detecting, exploiting, and remediating Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers two primary vulnerability types: direct references to database objects via user-controllable numeric IDs in URLs, query parameters, and request bodies, and direct references to static files such as PDFs and reports with predictable names. Detection techniques include URL and body parameter manipulation, HTTP method switching, and automated enumeration using Burp Suite Intruder across ID ranges from 1 to 10,000. The workflow requires at least two test accounts, an intercepting proxy, and written authorization before testing begins. Outputs include an IDOR vulnerability report, proof-of-concept evidence, a list of affected API endpoints, impact severity classification, and specific remediation recommendations to prevent unauthorized cross-user data access.