{"repo":"CypherNova1337/Auto-IDOR","free":true,"listed":false,"github":"https://github.com/CypherNova1337/Auto-IDOR","clone":"git clone https://github.com/CypherNova1337/Auto-IDOR.git","description":"An interactive bash script for detecting IDOR vulnerabilities. Automates the discovery of access control issues in web applications, enhancing the efficiency of bug bounty hunting.","language":"Python","stars":15,"topics":["automation","bugbounty","web-security","pentesting","reconnaissance","vulnerability-scanners","web-application-security"],"license":"MIT","category":"security-tools","readme_excerpt":"IDOR-Auto IDOR-Auto is an access-control testing tool for finding IDOR / BOLA (Broken Object-Level Authorization) vulnerabilities — including the complex ones that status-code scanners miss. It does not guess vulnerabilities from HTTP status codes. Instead it performs differential access testing : it drives several distinct identities against the same objects and proves whether one identity can obtain another's data. A finding means \"user A read user B's object\" , not \"the endpoint returned 200\" . For authorized security testing only — pentests, bug bounty within scope, and your own applications. See Disclaimer. --- Why this is different from a status-code scanner The classic approach (\"append an id, flag every 200 \") drowns you in false positives: plenty of endpoints legitimately return 200 . IDOR-Auto reasons about access using three reference responses for every object id: Reference Meaning ----------- --------- owner the victim identity reading its own object — the authorized truth attacker another identity trying to read the victim's object — the test denied the anonymous baseline — what properly refused looks like An IDOR is reported only when the attacker's response matches the owner's and differs from the denied baseline . If the attacker gets the same thing an anonymous user gets, the endpoint is simply public — reported as not-vulnerable , not as a false alarm. On top of that it understands the parts of real IDORs that trip up naive tools: - Canary / secret oracle —","default_branch":null,"files":null,"tree":[],"storefront":"/r/CypherNova1337","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/CypherNova1337/Auto-IDOR/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}