Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/attack-idor-automation
IDOR automated testing — cross-account access, horizontal/vertical privilege escalation, mass data exposure
Passed 19 of 22 test cases with the skill, and 10 of 22 without it.
and 6 more in the full report
9 fixed10 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
Which command line utility should be selected specifically for token header and payload manipulation during object reference testing?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies attack_script jwt_tamper for token modification | Missed | Passed |
The instructions your model reads when the skill loads.
Systematically test all API endpoints for Insecure Direct Object Reference vulnerabilities using two accounts with different privilege levels.
# Test endpoints from file
attack_script idor_tester \
--token-a "VICTIM_JWT" \
--token-b "ATTACKER_JWT" \
--endpoints endpoints.txt \
--json-output
# Test comma-separated endpoints
attack_script idor_tester \
--token-a "VICTIM_JWT" \
--token-b "ATTACKER_JWT" \
--endpoints "https://TARGET/api/users/123,https://TARGET/api/orders/456,https://TARGET/api/profile/123" \
--method GET
# Test write operations
attack_script idor_tester \
--token-a "VICTIM_JWT" \
--token-b "ATTACKER_JWT" \
--endpoints endpoints.txt \
--method PUT \
--data '{"name":"pwned"}'
test cases passed, vs 10 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.