What problem does it solve? Applications that expose internal object IDs without verifying ownership let attackers access other users' data, and these broken access control flaws are easy to miss during manual code review. This Skill provides a systematic procedure to locate, trace, and confirm IDOR vulnerabilities in source code. ## Core Features & Use Cases - Object Reference Discovery: Grep-based patterns to find object IDs in URL parameters, query strings, request bodies, and headers across JavaScript, TypeScript, Python, and Ruby codebases. - Authorization Gap Analysis: Structured checks for missing authentication, missing ownership verification, and bypass techniques like parameter pollution and type juggling. - Pattern Library: Six common IDOR patterns including horizontal and vertical privilege escalation, mass assignment, predictable IDs, nested resource flaws, plus GraphQL and API versioning specific guidance. - Use Case: While auditing a Node.js API before a bug bounty submission, run the procedure to find an endpoint like /api/orders/:id that authenticates users but never verifies order ownership, then document it with the included report template. ## Quick Start Analyze this codebase for IDOR vulnerabilities by tracing object references in API endpoints and checking whether each data access verifies resource ownership.
