idor-testing

仓库创建 2025年6月22日最近提交 1 天前SkillHot 收录 20 天前

▸ 精选理由

为红队与安全评估提供对象枚举与参数篡改流程参考。

▸ 风险提示

含可用于未授权访问的利用方法，务必在授权范围内使用。

这个 Skill 做什么

系统化检测与利用 Insecure Direct Object Reference（IDOR）漏洞的方法论。

系统化帮你寻找并验证 IDOR（Insecure Direct Object Reference）漏洞：通过参数篡改、ID 枚举和请求重放等手法判定能否越权读取或写入他人数据或静态文件。适合渗透测试或代码审核时，当怀疑存在 broken access control 就用。内容覆盖检测思路、用 Burp Suite 的利用流程和具体修复建议，既教你找漏洞也教你怎么修。

▸ 展开 SKILL.md 英文原文

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.

垂直行业IDOR漏洞检测权限绕过通用

4.4k

Stars

448

Forks

仓库内 Skill

+70

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/zebbern/claude-code-guide/main/skills/idor-testing/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/zebbern/claude-code-guide/main/skills/idor-testing/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# IDOR Vulnerability Testing

## Purpose

Provide systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. This skill covers both database object references and static file references, detection techniques using parameter manipulation and enumeration, exploitation via Burp Suite, and remediation strategies for securing applications against unauthorized access.

## Inputs / Prerequisites

- **Target Web Application**: URL of application with user-specific resources
- **Multiple User Accounts**: At least two test accounts to verify cross-user access
- **Burp Suite or Proxy Tool**: Intercepting proxy for request manipul

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有