Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →snailsploit/skill-insecure-direct-object-references-idor
- **Skill Name**: idor
Passed 6 of 22 test cases with the skill, and 14 of 22 without it.
2 fixed10 passed either way6 still failing4 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
When an application uses non-sequential 128-bit hexadecimal strings to reference user records, how should we test if access controls are properly enforced?
| Checked | Without skill | With skill |
|---|---|---|
| Suggests replacing one user's GUID with another user's GUID | Passed | Passed |
| Recommends searching client-side JavaScript to harvest GUIDs | Missed | Passed |
The instructions your model reads when the skill loads.
IDOR (Insecure Direct Object Reference) testing checklist: object ID enumeration, horizontal/vertical privilege escalation, GUID predictability, indirect references via hashes, chained IDOR, and API endpoint IDOR. Use for web app pentests and bug bounty IDOR discovery.
Use this skill when the conversation involves any of:
IDOR, insecure direct object reference, horizontal privilege escalation, vertical privilege escalation, object enumeration, GUID, API IDOR, mass assignment, broken access control
When this skill is active:
flowchart LR
A[Create Test Accounts] --> B[Discover Features]
B --> C[Intercept Traffic]
C --> D[Switch IDs in Requests]
D --> E{IDOR Found?}
E -->|Yes| F[Document Vulnerability]
E -->|No| G[Try Protection Bypass]
G --> H[Monitor Information Leaks]
test cases passed, vs 14 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.