domains / families / security / idor-broken-object-authorization

idor-broken-object-authorization

separate

IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.

When to use

• IDOR testing
• broken object authorization testing
• BOLA vs BFLA distinction
• A-B testing methodology
• horizontal privilege escalation
• vertical privilege escalation
• HTTP method escalation
• indirect IDOR testing

Skill page

Source