This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.
SkillScore73Maintained
Automatic
◆Security & AppSec pack
Last verified 8/10/2026
What it changes
Passed 16 of 22 test cases with the skill, and 14 of 22 without it.
Verifies whether the response body contains data belonging to the target account.
2 fixed14 passed either way6 still failing0 broke
Pass-rate lift
+9 pp
Tokens
+146%
Agent turns
0%
Response time
-14%
Model gemini-3.6-flashMeasured 8/10/2026v116 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 2
Prompt
During parameter enumeration, receiving an HTTP 200 OK status code on a modified resource request indicates what immediate analysis step is needed?
What was checked, without and with the skill
Checked
Without skill
With skill
Verifies whether the response body contains data belonging to the target account.
Missed
Passed
case-14 · gemini-3.6-flash · 8/10/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md434 linessingle file
IDOR Vulnerability Testing
Purpose
Provide systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. This skill covers both database object references and static file references, detection techniques using parameter manipulation and enumeration, exploitation via Burp Suite, and remediation strategies for securing applications against unauthorized access.
Inputs / Prerequisites
Target Web Application: URL of application with user-specific resources
Multiple User Accounts: At least two test accounts to verify cross-user access
Burp Suite or Proxy Tool: Intercepting proxy for request manipulation
Authorization: Written permission for security testing
Understanding of Application Flow: Knowledge of how objects are referenced (IDs, filenames)
Outputs / Deliverables
IDOR Vulnerability Report: Documentation of discovered access control bypasses
Proof of Concept: Evidence of unauthorized data access across user contexts
Affected Endpoints: List of vulnerable API endpoints and parameters
Impact Assessment: Classification of data exposure severity
Remediation Recommendations: Specific fixes for identified vulnerabilities
Core Workflow
1. Understand IDOR Vulnerability Types
Direct Reference to Database Objects
Occurs when applications reference database records via user-controllable parameters:
# Original URL (authenticated as User A)
example.com/user/profile?id=2023
# Manipulation attempt (accessing User B's data)
example.com/user/profile?id=2022
Direct Reference to Static Files
Occurs when applications expose file paths or names that can be enumerated: