Idor Broken Object Authorization

This is a comprehensive IDOR and broken object authorization testing playbook that goes well beyond the typical "increment the ID parameter" advice. It systematically covers A-B testing methodology, all the places object IDs hide (headers, cookies, GraphQL args, WebSocket messages), HTTP method escalation, and the crucial distinction between BOLA (accessing objects you don't own) and BFLA (accessing admin functions). The indirect IDOR section on reference chains and the mass assignment attacks are especially useful for finding non-obvious authorization bugs. Load this when you're testing anything with user data isolation, multi-tenant systems, or APIs that expose resource identifiers.

skills.sh installs: 4K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill idor-broken-object-authorization --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: IDOR / Broken Object Level Authorization — Expert Attack Playbook

AI LOAD INSTRUCTION: IDOR is the #1 bug bounty finding. This skill covers non-obvious IDOR surfaces, all attack vectors (not just URL params), A-B testing methodology, BOLA vs BFLA distinction, chaining IDOR to higher impact, and what testers repeatedly miss.

1. IDOR vs BOLA vs BFLA

Term	Meaning	Impact
IDOR	Insecure Direct Object Reference	Read/modify other users' data
BOLA	Broken Object Level Authorization (OWASP API Top 10 A1)	Same as IDOR, API terminology
BFLA	Broken Function Level Authorization	Low-priv user accesses HIGH-PRIV functions (e.g., admin endpoints)

Key distinction:

BOLA = accessing object you shouldn't own (data belonging to other users)
BFLA = accessing function you shouldn't be authorized for (admin CRUD operations, bulk actions, user management)