Strix•IDOR 测试
Strix IDOR/BOLA 测试手册,覆盖对象级授权失效与跨账户数据访问;触发名:strix-idor
Profile →npx skills add asdfgh1445/ctf-super-hub --skill strix-idor --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# IDOR Object-level authorization failures (BOLA/IDOR) lead to cross-account data exposure and unauthorized state changes across APIs, web, mobile, and microservices. Treat every object reference as untrusted until proven bound to the caller. ## Attack Surface **Scope** - Horizontal access: access another subject's objects of the same type - Vertical access: access privileged objects/actions (admin-only, staff-only) - Cross-tenant access: break isolation boundaries in multi-tenant systems - Cross-service access: token or context accepted by the wrong service **Reference Locations** - Paths, query params, JSON bodies, form-data, headers, cookies - JWT claims, GraphQL arguments, WebSocket messages, gRPC messages **Identifier Forms** - Integers, UUID/ULID/CUID, Snowflake, slugs - Composite keys (e.g., `{orgId}:{userId}`) - Opaque tokens, base64/hex-encoded blobs **Relationship References** - parentId, ownerId, accountId, tenantId, organization, teamId, projectId, subscriptionId **Expansion/Projection Knobs** - `fields`, `include`, `expand`, `projection`, `with`, `select`, `populate` - Often bypass authorization in resolvers or serializers ## High-Value Targets - Exports/backups/report
- Attack Surface
- High-Value Targets
- Reconnaissance
- Key Vulnerabilities
- Horizontal & Vertical Access
- Bulk & Batch Operations
- Secondary IDOR
- Job/Task Objects
- File/Object Storage
- GraphQL
- Microservices & Gateways
- Multi-Tenant
- WebSocket
- gRPC
What does the Strix•IDOR 测试 skill do?
Strix IDOR/BOLA 测试手册,覆盖对象级授权失效与跨账户数据访问;触发名:strix-idor
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill strix-idor --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.