Idor Harness

For EVERY endpoint before testing:

# 1. No auth
curl -s https://target.com/api/resource/123 -o no_auth.json
# 2. User A auth
curl -s https://target.com/api/resource/123 -H "Cookie: session=userA" -o user_a.json
# 3. User B auth
curl -s https://target.com/api/resource/123 -H "Cookie: session=userB" -o user_b.json

Decision gate:

Step 3 - ID Type Decision Tree

Step 4 - Run Automated Harness

python {AGENT}/engine/core/idor_harness.py \
  {FINDINGS}/phases/api-schema.json \
  {FINDINGS}/credentials/{target}-creds.env \
  {FINDINGS}/credentials/{target}-creds-b.env \
  --out {FINDINGS}/phases/idor-results.json 2>&1 | tee {FINDINGS}/tmp/idor-run.txt

Decision gate on results:

Step 5 - Manual Verification and CRUD Expansion

For every candidate from Step 4 or discovered endpoints:

# GET - read IDOR
curl -s -H "Authorization: Bearer $TOKEN_B" \
  https://target.com/api/v1/orders/98765 > {FINDINGS}/tmp/order-b.json

# GATE: 200 with User A's data? -> Document. Then test write operations:

# PUT/PATCH - write IDOR (High-Critical)
curl -s -X PUT -H "Authorization: Bearer $TOKEN_B" \
  -H "Content-Type: application/json" \
  -d '{"name":"IDOR-TEST"}' \
  https://target.com/api/v1/orders/98765

# DELETE - destructive IDOR (Critical)
curl -s -o /dev/null -w "%{http_code}" -X DELETE \
  -H "Authorization: Bearer $TOKEN_B" \
  https://target.com/api/v1/orders/98765
# GATE: 200/204 on DELETE -> STOP. This is Critical. Report immediately.

Step 6 - Chain Escalation

GATE: Any chain that reaches ATO -> STOP testing other endpoints. Report the chain.

Proof Standard

Every IDOR report MUST contain:

"User B's Bearer token was used. User A's resource ID ({id}) was used in the request. The response returned User A's private data including {field}. User B has no legitimate access to User A's account."

Minimum evidence:

• curl command with User B's token (redacted to first 8 chars) and User A's ID
• Raw response showing User A's data
• Screenshot or GIF of the request/response

False Positive Checklist

Before reporting, confirm ALL of these:

• Response contains user-SPECIFIC data (not shared config/public resource)
• Unauthenticated request does NOT return the same data
• User B's token was used (not User A's - double check)
• The ID is not a public share token (test with no auth - if 200, it's intentional sharing)

GATE: Any checkbox fails -> NOT an IDOR. Do not report.

Concurrent Authorization Testing (Optional, after standard IDOR)

Race conditions in authorization logic during state transitions:

import threading, requests

def concurrent_test(url_a: str, headers_a: dict, url_b: str, headers_b: dict) -> dict:
    results = [None, None]
    def req_a(): results[0] = requests.get(url_a, headers=headers_a)
    def req_b(): results[1] = requests.get(url_b, headers=headers_b)
    t1 = threading.Thread(target=req_a)
    t2 = threading.Thread(target=req_b)
    t1.start(); t2.start()
    t1.join(timeout=10); t2.join(timeout=10)
    return {"a_status": results[0].status_code, "b_status": results[1].status_code}

Run 5x minimum. Intermittent races need 5+ reproductions in evidence. CVSS: AC:H unless window > 100ms.

When to Stop

All endpoints tested with no candidates -> move on
All candidates verified as false positives -> move on
Write IDOR found -> report immediately, then continue testing remaining endpoints
2+ hours with no real IDOR -> move to next attack surface