メニュー
Use when performing penetration testing targeting insecure direct object reference vulnerabilities. Keywords: IDOR, broken object level authorization, BOLA, parameter tampering, horizontal privilege escalation, API authorization, UUID guessing
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when building or updating vulnerability pattern Skills from multiple sources: GitHub Security Advisories (GHSA), HackerOne Hacktivity, or NVD. Triggers on keywords: GHSA, CVE, vulnerability skill, vuln pattern, update skills, security advisory, HackerOne, H1, hacktivity, pentest skill, bug bounty, check for updates.
Use when building or updating vulnerability pattern Skills from multiple sources: GitHub Security Advisories (GHSA), HackerOne Hacktivity, or NVD. Triggers on keywords: GHSA, CVE, vulnerability skill, vuln pattern, update skills, security advisory, HackerOne, H1, hacktivity, pentest skill, bug bounty, check for updates.
Use when auditing Go code involving authentication flows, RBAC policies, Kubernetes admission webhooks, JWT/OAuth token validation, or privilege escalation in cloud-native infrastructure. Covers CWE-287/863/269/284/285/862. Keywords: authentication bypass, authorization bypass, RBAC, admission webhook, JWT, OAuth, privilege escalation, Rancher, Kyverno, impersonation, namespace isolation, middleware auth
Use when auditing Go code involving TLS configuration, certificate validation, JWT token parsing, SAML assertion verification, webhook signature checking, or cryptographic operations. Covers CWE-295/347/345. Keywords: InsecureSkipVerify, TLS, mTLS, certificate validation, JWT algorithm, SAML signature, cosign, sigstore, hmac.Equal, X.509, webhook HMAC
Use when auditing Go code involving goroutine management, channel operations, HTTP request handling, resource allocation, or panic recovery. Covers CWE-400/770/476. Keywords: denial of service, goroutine leak, channel deadlock, panic recover, io.ReadAll, resource exhaustion, OOM, HTTP/2 abuse, protobuf, unbounded allocation, rate limiting
Use when auditing Go code involving logging, error handling, HTTP response data, Kubernetes Secret management, or credential storage. Covers CWE-200/532/522/312/552. Keywords: information disclosure, credential leak, log exposure, Kubernetes Secret, json tag, struct formatting, error message, stack trace, Rancher, Argo CD, sensitive data
| name | pentest-idor |
| description | Use when performing penetration testing targeting insecure direct object reference vulnerabilities. Keywords: IDOR, broken object level authorization, BOLA, parameter tampering, horizontal privilege escalation, API authorization, UUID guessing |
当对 Web 应用进行 IDOR 渗透测试时加载此 Skill。覆盖水平越权、API 对象级授权缺失等。
高风险端点特征：
/api/users/123、/orders/456?user_id=123、?account_id=456/download?file_id=789识别信号：
id: 1001, 1002, 1003）基础测试方法：
参数篡改：
# 替换 ID 值
GET /api/users/1001/profile → GET /api/users/1002/profile
# 批量替换（Burp Intruder）
GET /api/orders/$ID$ → 遍历 1-10000
# 修改请求体中的 ID
POST /api/transfer {"from_account": "mine", "to_account": "mine"}
→ {"from_account": "victim", "to_account": "mine"}
HTTP 方法切换：
X-HTTP-Method-Override: DELETE 头绕过方法限制GraphQL IDOR：
# 查询其他用户的私密数据
query { user(id: "other-user-id") { email, phone, address } }
# Mutation 修改其他用户数据
mutation { deleteProfileImages(userId: "other-user-id") { success } }
高级技巧：
/org/123/users/456（先遍历 org ID 再遍历 user ID）/api/bulk-delete 中混入其他用户的 IDmember_id 参数接管其他用户的关联POST /api/users {"name":"test","role":"admin"} 通过额外字段修改权限OWASP API Security 参考：
member_id、account_id）进行账户接管漏洞利用可达到的效果：
严重度判断：
以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。
A vulnerability was reported that allowed sale cancellations from other sellers without restrictions. The issue was acknowledged and addressed by MercadoLibre.