IDOR Testing Checklist
Guides the agent through a structured checklist for finding insecure direct object reference bugs in web apps
- Repository
- SnailSploit/Claude-Red
- Stars
- 10,230
- Licence
- MIT
- Files
- 1 file
What it does
This skill gives the AI agent a detailed checklist for testing whether a web application lets one user reach another user's data by changing an ID in a request, such as a user number, file name, or unique identifier. Once installed, the agent follows the steps in order: create test accounts, find features that expose or change data, intercept requests with a proxy, swap identifiers, and try bypass techniques if the first attempts fail. It then suggests next steps based on what it finds. The file is a text methodology only; it contains no scripts.
Great for
- Security testers running authorized web or API penetration tests
- Bug bounty hunters looking for broken access control on in-scope targets
- Developers or students learning how IDOR flaws arise and how to check for them
Skip it if
- Testing systems you do not own or have written permission to test, because switching IDs on other people's accounts can be illegal and cause real harm
- Developers who only need to fix access control, since the file focuses on attacking and does not explain secure implementation patterns in depth
Try asking
- “Use the IDOR checklist to review the order and invoice endpoints on our staging app for horizontal privilege escalation.”
- “Walk me through testing the /api/messages endpoint for missing user_id authorization checks.”
- “Help me plan an IDOR test for our bug bounty target, starting with creating two test accounts.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
offensive-idor.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip offensive-idor.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip offensive-idor.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Only use it against applications you are authorised to test, and state the scope in your request so the agent stays within it.
- Provide your proxy traffic or endpoint list so the agent can tailor the checklist to the actual requests rather than working generically.
- Ask the agent to record which checklist items are complete, since the skill asks it to track progress.
What's inside
- SKILL.md
Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.