Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

offensive-idor

Estrellas54

Forks65

Actualizado21 de junio de 2026 a las 23:49

Insecure Direct Object Reference (IDOR) testing skill focused on Azure resource identifiers and API endpoints. Covers GUID enumeration, horizontal/vertical privilege escalation, and Azure-specific object reference vulnerabilities.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

openshield-org

openshield-org/openshield

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	offensive-idor
description	Insecure Direct Object Reference (IDOR) testing skill focused on Azure resource identifiers and API endpoints. Covers GUID enumeration, horizontal/vertical privilege escalation, and Azure-specific object reference vulnerabilities.
domain	cybersecurity
subdomain	web-security
tags	["idor","azure","api-security","guidance","web-security"]
version	1.0
author	openshield
license	Apache-2.0
nist_csf	["PR.AC-4","PR.AC-7","PR.DS-1","DE.CM-1"]

Insecure Direct Object References (IDOR) — Azure Offensive Methodology

When to Use

When testing Azure-hosted web applications and APIs that use resource identifiers (IDs, GUIDs) in requests.
When validating if users can access or modify resources belonging to other tenants or users.
When assessing the security of Azure Storage pre-signed URLs (SAS tokens) as object references.
When performing security audits of internal administrative portals that manage Azure resources.

Key Concepts

Term	Definition
Horizontal Escalation	Accessing resources of another user with the same privilege level
Vertical Escalation	Accessing resources that require a higher privilege level (e.g., admin)
BOLA	Broken Object Level Authorization, the API-specific term for IDOR
SAS Token	Azure Storage Shared Access Signature, often used as a direct object reference

Detection & Exploitation

API IDOR Discovery

Many Azure-integrated apps use GUIDs. While GUIDs are not sequential, they may be leaked in other API responses.

# Example: Accessing a profile by ID
GET /api/v1/users/a1b2c3d4-e5f6-7890-abcd-ef1234567890/settings

# Test: Replace with a victim's GUID found in a search or list endpoint
GET /api/v1/users/<victim-guid>/settings

Azure Storage SAS Token Manipulation

SAS tokens are often used to grant temporary access to blobs. If the token is not scoped correctly or has a long expiry, it acts as a vulnerable object reference.

# Test for scope: Can I access another blob in the same container?
https://mystorage.blob.core.windows.net/mycontainer/secret.txt?<sas-token>
# Change to:
https://mystorage.blob.core.windows.net/mycontainer/other_user_file.txt?<sas-token>

Remediation Reference

Check Ownership: Always verify on the server side that the authenticated user owns the object they are requesting.
Use UUIDs: While not a replacement for auth, using non-sequential UUIDs prevents basic enumeration.
Scope SAS Tokens: Always use the most restrictive permissions and shortest possible expiry for SAS tokens.

Más de este repositorio

mismo repositorio

post-quantum-cryptography-azure

openshield-org/openshield

Identifies and remediates non-quantum-safe cryptographic configurations in Azure including classical TLS key exchange, RSA and ECC keys in Key Vault, and classical certificate algorithms. Maps findings to NIST PQC standards FIPS 203, FIPS 204, and FIPS 205. Use when assessing quantum readiness of Azure infrastructure or building a Cryptographic Bill of Materials.

2026-07-1454

analyzing-azure-activity-logs-for-threats

openshield-org/openshield

Queries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.

2026-06-2154

analyzing-cloud-storage-access-patterns

openshield-org/openshield

Detect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration.

2026-06-2154

auditing-azure-active-directory-configuration

openshield-org/openshield

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, and guest user risks.

2026-06-2154

auditing-cloud-with-cis-benchmarks

openshield-org/openshield

Conduct cloud security audits using Center for Internet Security (CIS) benchmarks for Azure. Covers interpreting CIS Foundations Benchmark controls, running automated assessments, and maintaining continuous compliance monitoring.

2026-06-2154

building-cloud-siem-with-sentinel

openshield-org/openshield

Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.

2026-06-2154

Insecure Direct Object References (IDOR) — Azure Offensive Methodology

When to Use

When testing Azure-hosted web applications and APIs that use resource identifiers (IDs, GUIDs) in requests.

When validating if users can access or modify resources belonging to other tenants or users.

When assessing the security of Azure Storage pre-signed URLs (SAS tokens) as object references.

When performing security audits of internal administrative portals that manage Azure resources.

Key Concepts

Term

Definition

Horizontal Escalation

Accessing resources of another user with the same privilege level

Vertical Escalation

Accessing resources that require a higher privilege level (e.g., admin)

BOLA

Broken Object Level Authorization, the API-specific term for IDOR

SAS Token

Azure Storage Shared Access Signature, often used as a direct object reference

Detection & Exploitation

API IDOR Discovery

Many Azure-integrated apps use GUIDs. While GUIDs are not sequential, they may be leaked in other API responses.

# Example: Accessing a profile by ID GET /api/v1/users/a1b2c3d4-e5f6-7890-abcd-ef1234567890/settings # Test: Replace with a victim's GUID found in a search or list endpoint GET /api/v1/users/<victim-guid>/settings

Azure Storage SAS Token Manipulation

SAS tokens are often used to grant temporary access to blobs. If the token is not scoped correctly or has a long expiry, it acts as a vulnerable object reference.

# Test for scope: Can I access another blob in the same container? https://mystorage.blob.core.windows.net/mycontainer/secret.txt?<sas-token> # Change to: https://mystorage.blob.core.windows.net/mycontainer/other_user_file.txt?<sas-token>

Remediation Reference

Check Ownership: Always verify on the server side that the authenticated user owns the object they are requesting.

Use UUIDs: While not a replacement for auth, using non-sequential UUIDs prevents basic enumeration.

Scope SAS Tokens: Always use the most restrictive permissions and shortest possible expiry for SAS tokens.