Idor

Skill sunilgentyala/OmniRed/skills/web/idor

OmniRed: Multi-AI offensive security skills library for Claude, ChatGPT, Gemini & Microsoft Copilot — with unique MCP, LLM-pipeline, and AI-native attack categories. By Sunil Gentyala, Independent Researcher.

Install

npx -y skills add sunilgentyala/OmniRed --skill idor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Insecure Direct Object Reference (IDOR) methodology. Covers horizontal and vertical privilege escalation, GUID bypass, mass assignment, and multi-step IDOR chains.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.1 KB, as published. Nobody here has run it

Insecure Direct Object Reference (IDOR)

Discovery

Map all object identifiers in API responses and URL parameters: numeric IDs, GUIDs, hashes, filenames. For each identifier:

Is it predictable? (sequential integers → enumerate)
Does changing it return another user's data? (horizontal IDOR)
Does changing it return admin/privileged data? (vertical IDOR)

Testing Methodology

Horizontal IDOR (access peer resources)

GET /api/users/1001/profile    → your profile
GET /api/users/1002/profile    → another user's profile (IDOR if successful)

GET /api/orders/55512          → your order
GET /api/orders/55511          → another user's order (IDOR)

Vertical IDOR (access higher-privilege resources)

GET /api/admin/users           → with user-level token (403 expected)
GET /api/invoices/INV-2024-001 → with user-level token (403 expected, return 200 = IDOR)

GUID bypass techniques

Obtain a valid GUID for another user via:

API response leakage (user objects containing other users' IDs)
Email/notification references
Public profile pages
Shared resource references

Indirect IDOR

POST /api/messages
Body: {"recipient_id": 9999, "message": "test"}
→ Does the server validate that recipient_id belongs to an accessible user?

Mass assignment IDOR

PUT /api/users/1001
Body: {"name": "Test", "role": "admin"}
→ Does the server accept and apply the "role" field?

Chaining IDORs

Combine multiple low-severity IDORs for critical impact:

IDOR #1 — leak email via profile endpoint
IDOR #2 — use leaked email to trigger password reset
Result: account takeover from information disclosure

Tools

Burp Suite Intruder — enumerate IDs
Autorize — Burp extension for IDOR automation
Manual API exploration with multiple test accounts

OWASP Mapping

A01:2021 — Broken Access Control