# Hunt Idor

Hunting skill for idor vulnerabilities.

- Repository: https://github.com/elementalsouls/Claude-BugHunter (5368 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-idor -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-idor -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-idor -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-idor -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elementalsouls/Claude-BugHunter`

## Description

Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

## Crown Jewel Targets

**Why IDOR pays big:**
- Direct access to other users' data without authentication bypass, clear, demonstrable impact
- Chains easily with privilege escalation, financial fraud, and account takeover
- Affects virtually every application with user-owned resources

**Highest-value asset types (by payout potential):**

| Asset Type | Why It Pays |
|---|---|
| Financial documents / billing APIs | PII + financial data exposure (Shopify, Uber, PayPal) |
| Private repositories / source code | IP theft, critical data loss (GitHub) |
| User messages / DMs | Privacy violation at scale (Reddit) |
| Account management endpoints | User addition, deletion, privilege escalation (PayPal, Mozilla) |
| Business/org administration | Cross-tenant escalation, employee PII (Uber) |
| Content moderation/admin actions | Operational sabotage (Reddit mod logs) |

**Programs that pay most for IDOR:**
- Platforms with multi-tenancy (SaaS, B2B tools)
- Fintech and payment processors
- Social platforms with private content
- Developer tools with org/repo isolation

---

## Attack Surface Signals

**URL patterns that scream IDOR:**
```
/api/v1/users/{id}/
/api/v*/orders/{order_id}
/invoices/download?id=
/reports/{uuid}/
/messages/{thread_id}
/admin/orgs/{org_id}/members
/migration/{migration_id}/files
/graphql (query params with IDs)
/api/business/{business_id}/
/vouchers/{voucher_id}/policy
```

**Response header signals:**
- `Content-Type: application/json` on endpoints accepting raw IDs
- No `X-Frame-Options` or CORS misconfigs paired with ID params
- `Authorization: Bearer` tokens that are user-scoped but hit org-level resources

**JavaScript source patterns:**
```javascript
// Look for hardcoded or interpolated IDs in JS
fetch(`/api/v1/users/${userId}/profile`)
axios.get('/invoices/' + invoiceId)
graphql query { billingDocument(id: $docId) }
// Redux/state stores exposing foreign IDs
state.currentUser.organizationId
```

The rest: https://github.com/elementalsouls/Claude-BugHunter/blob/HEAD/skills/hunt-idor/SKILL.md