domains / families / security / offensive-idor

offensive-idor

separate

A testing checklist for Insecure Direct Object References (IDOR) covering object ID enumeration, privilege escalation, and API endpoint IDOR. Used for web application penetration tests and bug bounty IDOR discovery.

When to use

• object ID enumeration
• horizontal privilege escalation
• vertical privilege escalation
• GUID predictability
• indirect references via hashes
• chained IDOR
• API endpoint IDOR
• web app pentests

Skill page

Source