Summary
IDOR 不安全直接对象引用与未授权访问检测与利用。当 API/URL 中出现 user_id、account、订单号、文件名等可预测标识符，或需要测试水平越权（访问他人数据）、垂直越权（普通用户获取 admin 管理员权限）、接口越权时使用。覆盖 ID 遍历、绕过技巧（参数污染/编码/方法切换）、多步 IDOR…
wgpsec/aboutsecurity
idor-methodology
IDOR 不安全直接对象引用与未授权访问检测与利用。当 API/URL 中出现 user_id、account、订单号、文件名等可预测标识符，或需要测试水平越权（访问他人数据）、垂直越权（普通用户获取 admin 管理员权限）、接口越权时使用。覆盖 ID 遍历、绕过技巧（参数污染/编码/方法切换）、多步 IDOR 链、文件资源 IDOR、批量操作越权、间接引用枚举、框架特征利用、UUID 猜测、响应对比分析、写操作越权、JWT Claims 篡改、token/session 权限校验绕过、role/permission 检查缺失。发现 API 端点后务必加载本 skill 检查越权和未授权访问问题
Installation
$
npx skills add https://github.com/wgpsec/aboutsecurity
Similar popular skills
Related neighbors and high-traction skills in the same topics — useful to compare before installing.
evaluation-methodology
Similar name
wshobson/agents
PluginEval quality methodology — dimensions, rubrics, statistical methods, and scoring formulas…
25 installs
cro-methodology
Similar name
wondelai/skills
Audit websites and landing pages for conversion issues and design evidence-based A/B tests. Use…
40 installs
benchmark-methodology
Similar name
affaan-m/ecc
>- Use after competitive-platform-analysis has produced a tiered competitor set. Scores each co…
63 installs
recon-and-methodology
Similar name
yaklang/hack-skills
>- Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fin…
24 installs
sparc-methodology
Similar name
ruvnet/ruflo
SPARC (Specification, Pseudocode, Architecture, Refinement, Completion) comprehensive developme…
1.2K installs
ethical-hacking-methodology
Similar name
sickn33/agentic-awesome-skills
Master the complete penetration testing lifecycle from reconnaissance through reporting. This s…
711 installsAlso in this package
Other skills from wgpsec/aboutsecurity · top by installs.
npx skills add https://github.com/wgpsec/aboutsecurity
More details
Agent compatibility
Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.
Claude Code
Not declared
Cursor
Not declared
Codex
Not declared
GitHub Copilot
Not declared
Windsurf
Not declared
Gemini CLI
Not declared
Cline
Not declared
OpenCode
Not declared
Repository health
Stars
1.7K
Default branch
master
Open issues
0
Status
Active
History
- First seen on skills.sh
- First recorded snapshot · 20 installs