What problem does it solve? Finding Insecure Direct Object Reference (IDOR) vulnerabilities requires systematic testing of object-level authorization across every endpoint, HTTP verb, and tenant boundary — a process that is easy to do incompletely and hard to prove with the reproducible evidence bug bounty programs demand. ## Core Features & Use Cases - Systematic IDOR Methodology: A 10-step workflow covering object reference mapping, ID enumeration, two-account differential testing, cross-tenant scenarios, GraphQL resolvers, and destructive verb testing. - Payloads and Bypass Techniques: Ready-to-use curl, ffuf, and Burp Intruder commands plus bypasses for UUIDs, hashed references, rate limits, WAF filtering, and HTTP parameter pollution. - Chain Compositions: Six senior-level chains that escalate read-only IDORs into account takeover, financial fraud, role escalation, and mass data extraction for higher-severity reports. - Use Case: While testing a SaaS target, you find /api/v1/invoices/{id} returns another user's billing document with your session. The skill guides you to test write verbs, chain the leaked org IDs into a second IDOR, and pass the Gate 0 reproducibility check before filing. ## Quick Start Ask the agent to hunt for IDOR vulnerabilities on your authorized bug bounty target's API endpoints using two test accounts.
