# idor-testing

A testing skill for discovering IDOR flaws and broken access controls in web apps. Useful for checking whether users can reach unauthorized records or files.

- skill · `type=skill` · Claude Code · 122 installs
- Author: zebbern
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/idor-testing
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/idor-testing

## What it does

This skill guides developers through testing web apps for Insecure Direct Object References. It details techniques for altering IDs in query parameters and JSON payloads. It also covers trying alternate HTTP verbs when a standard `GET` endpoint returns forbidden.

The testing workflow relies on Burp Suite for request interception and parameter cycling in Intruder. You must obtain written testing consent and prepare at least two distinct user accounts before starting. Single accounts are not enough to confirm data leakage.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/idor-testing
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill idor-testing -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/idor-testing/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/idor-testing/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/idor-testing/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/idor-testing/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates idor-testing
```

2. **Manually: put the files in place**
- File: `.github/skills/idor-testing/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/idor-testing
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/idor-testing/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/idor-testing

## When to use it
- locate direct database object references in API paths
- test access boundaries on protected file downloads
- spot authorization bypasses caused by HTTP method switching
- prepare automated parameter fuzzing runs in Burp Suite

## Example prompts
- Check if the `/api/user/profile?id=1001` endpoint exposes IDOR issues
- Help me configure Burp Suite Intruder to test user ID enumeration
- Draft a remediation recommendation for an access control bypass on file receipts

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 804 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md