메뉴
Insecure Direct Object Reference (IDOR) testing skill focused on Azure resource identifiers and API endpoints. Covers GUID enumeration, horizontal/vertical privilege escalation, and Azure-specific object reference vulnerabilities.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Identifies and remediates non-quantum-safe cryptographic configurations in Azure including classical TLS key exchange, RSA and ECC keys in Key Vault, and classical certificate algorithms. Maps findings to NIST PQC standards FIPS 203, FIPS 204, and FIPS 205. Use when assessing quantum readiness of Azure infrastructure or building a Cryptographic Bill of Materials.
Queries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.
Detect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration.
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, and guest user risks.
Conduct cloud security audits using Center for Internet Security (CIS) benchmarks for Azure. Covers interpreting CIS Foundations Benchmark controls, running automated assessments, and maintaining continuous compliance monitoring.
Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.
| name | offensive-idor |
| description | Insecure Direct Object Reference (IDOR) testing skill focused on Azure resource identifiers and API endpoints. Covers GUID enumeration, horizontal/vertical privilege escalation, and Azure-specific object reference vulnerabilities. |
| domain | cybersecurity |
| subdomain | web-security |
| tags | ["idor","azure","api-security","guidance","web-security"] |
| version | 1.0 |
| author | openshield |
| license | Apache-2.0 |
| nist_csf | ["PR.AC-4","PR.AC-7","PR.DS-1","DE.CM-1"] |
| Term | Definition |
|---|---|
| Horizontal Escalation | Accessing resources of another user with the same privilege level |
| Vertical Escalation | Accessing resources that require a higher privilege level (e.g., admin) |
| BOLA | Broken Object Level Authorization, the API-specific term for IDOR |
| SAS Token | Azure Storage Shared Access Signature, often used as a direct object reference |
Many Azure-integrated apps use GUIDs. While GUIDs are not sequential, they may be leaked in other API responses.
# Example: Accessing a profile by ID
GET /api/v1/users/a1b2c3d4-e5f6-7890-abcd-ef1234567890/settings
# Test: Replace with a victim's GUID found in a search or list endpoint
GET /api/v1/users/<victim-guid>/settings
SAS tokens are often used to grant temporary access to blobs. If the token is not scoped correctly or has a long expiry, it acts as a vulnerable object reference.
# Test for scope: Can I access another blob in the same container?
https://mystorage.blob.core.windows.net/mycontainer/secret.txt?<sas-token>
# Change to:
https://mystorage.blob.core.windows.net/mycontainer/other_user_file.txt?<sas-token>