{"id":44736966,"url":"https://github.com/ralianeng/idor-otaku","last_synced_at":"2026-02-23T12:45:29.268Z","repository":{"id":337452322,"uuid":"1141713467","full_name":"RalianENG/IDOR-otaku","owner":"RalianENG","description":"mitmproxy-based IDOR detection tool that tracks parameter flows to find insecure direct object references","archived":false,"fork":false,"pushed_at":"2026-02-09T17:44:47.000Z","size":395,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-02-09T19:52:50.057Z","etag":null,"topics":["cli","idor","mitmproxy","pentesting","python","security","security-tools","vulnerability-detection"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/RalianENG.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-01-25T09:45:51.000Z","updated_at":"2026-02-09T17:44:19.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/RalianENG/IDOR-otaku","commit_stats":null,"previous_names":["ralianeng/idor-otaku"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/RalianENG/IDOR-otaku","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RalianENG%2FIDOR-otaku","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RalianENG%2FIDOR-otaku/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RalianENG%2FIDOR-otaku/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RalianENG%2FIDOR-otaku/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/RalianENG","download_url":"https://codeload.github.com/RalianENG/IDOR-otaku/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RalianENG%2FIDOR-otaku/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29487800,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-15T19:29:10.908Z","status":"ssl_error","status_checked_at":"2026-02-15T19:29:10.419Z","response_time":118,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","idor","mitmproxy","pentesting","python","security","security-tools","vulnerability-detection"],"created_at":"2026-02-15T20:05:00.857Z","updated_at":"2026-02-23T12:45:29.259Z","avatar_url":"https://github.com/RalianENG.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# IDOR-otaku (idotaku)\n\n[![CI](https://github.com/RalianENG/IDOR-otaku/actions/workflows/ci.yml/badge.svg)](https://github.com/RalianENG/IDOR-otaku/actions/workflows/ci.yml)\n[![Coverage](https://codecov.io/gh/RalianENG/IDOR-otaku/graph/badge.svg)](https://codecov.io/gh/RalianENG/IDOR-otaku)\n[![PyPI version](https://img.shields.io/pypi/v/idotaku)](https://pypi.org/project/idotaku/)\n[![Python](https://img.shields.io/pypi/pyversions/idotaku)](https://pypi.org/project/idotaku/)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Code style: ruff](https://img.shields.io/badge/code%20style-ruff-000000.svg)](https://github.com/astral-sh/ruff)\n\n**IDOR-otaku** — A reconnaissance tool that tracks how IDs flow through your API traffic to uncover IDOR attack surfaces. No Burp Suite required.\n\nUnlike fully automated verification tools (Autorize, AuthMatrix), idotaku maps _where_ IDs originate, how they propagate across requests, and which ones appear without a traceable origin — revealing the attack surface before you start testing. The `verify` command lets you selectively test IDOR candidates with explicit confirmation at every step.\n\n### Why idotaku?\n\n- **ID lifecycle visibility** — Tracks where IDs are born (responses) and where they travel (requests). Visualizes parameter chains and API sequence diagrams as interactive HTML.\n- **No Burp Suite required** — `pip install idotaku` and go. Works as a standalone CLI tool with mitmproxy.\n- **HAR import** — Analyze traffic captured from Chrome DevTools, Burp Suite, or any other tool. No proxy setup needed for offline analysis.\n- **CI/CD ready** — SARIF export integrates directly with GitHub Code Scanning. CSV export for custom pipelines.\n- **Built-in verification** — `verify` command sends modified requests with user confirmation at every step. Supports proxy passthrough (Burp/ZAP).\n\n\u003e **IDOR (Insecure Direct Object Reference)** is a vulnerability where an application exposes internal object IDs (user IDs, order numbers, etc.) without proper authorization checks, allowing attackers to access other users' data by manipulating these IDs.\n\n## How It Works\n\n```\n┌─────────────┐     ┌─────────────┐     ┌─────────────┐\n│   Browser   │────\u003e│  mitmproxy  │────\u003e│  API Server  │\n└─────────────┘     └──────┬──────┘     └─────────────┘\n                           │\n                           v\n                    ┌─────────────┐\n                    │  idotaku    │\n                    │  (tracker)  │\n                    └──────┬──────┘\n                           │\n                           v\n                    ┌─────────────┐\n                    │   Report    │\n                    │   (JSON)    │\n                    └─────────────┘\n```\n\n1. **Intercept** — Proxies browser traffic via mitmproxy\n2. **Track** — Records full HTTP data: where IDs first appear (response) and where they are used (request), including headers, body, and status codes\n3. **Detect** — Flags IDs used in requests that never appeared in any response (IDOR candidates)\n4. **Visualize** — Renders parameter chains and API sequence diagrams as interactive HTML\n5. **Verify** — Interactively test IDOR candidates by sending modified requests with user confirmation\n\n## Requirements\n\n- Python 3.12+\n- mitmproxy 11.0+\n\n## Installation\n\n```bash\npip install idotaku\n```\n\n## Quick Start\n\n```bash\n# Interactive mode (recommended for beginners)\nidotaku -i\n\n# Start proxy directly\nidotaku\n\n# Analyze report\nidotaku report id_tracker_report.json\nidotaku chain id_tracker_report.json --html chain.html\nidotaku sequence id_tracker_report.json --html sequence.html\n\n# Import HAR file (from Chrome DevTools, Burp Suite, etc.)\nidotaku import-har capture.har -o report.json\n```\n\n## Demo\n\nTry idotaku with a built-in vulnerable API that demonstrates all detection capabilities:\n\n```bash\ncd examples/vulnerable_api\n\n# One-command demo (Linux/macOS)\nbash run_demo.sh\n\n# Cross-platform (Windows/macOS/Linux)\npython run_demo.py\n```\n\nThe demo starts a vulnerable FastAPI server, proxies traffic through idotaku,\nruns an automated attack scenario, and generates analysis reports.\n\n### What You'll See\n\n**Risk Scoring** — Four severity levels from a single test scenario:\n\n```\nScore  Level     ID Value              Type     Factors\n─────  ────────  ────────────────────  ───────  ──────────────────────────\n89     CRITICAL  1003                  numeric  DELETE, url_path, numeric\n65     HIGH      1002                  numeric  PUT, url_path, numeric\n46     MEDIUM    b2c3d4e5-f6a7-...     uuid     POST, body, uuid\n18     LOW       doc_YzAbCdEfGh...     token    GET, header, token\n```\n\n![Risk Scores](https://raw.githubusercontent.com/RalianENG/IDOR-otaku/main/docs/images/demo-score.png)\n\n**Parameter Chains** and **Sequence Diagrams** are exported as interactive HTML:\n\n```bash\n# Generated by the demo script:\n# examples/vulnerable_api/chain.html     — card-based parameter chain tree\n# examples/vulnerable_api/sequence.html  — UML-style API sequence diagram\n```\n\n![Chain HTML](https://raw.githubusercontent.com/RalianENG/IDOR-otaku/main/docs/images/demo-chain-html.png)\n![Sequence Diagram](https://raw.githubusercontent.com/RalianENG/IDOR-otaku/main/docs/images/demo-sequence-html.png)\n\nSee [examples/vulnerable_api/](examples/vulnerable_api/) for details, or the\n[Quick Start Guide](https://github.com/RalianENG/IDOR-otaku/blob/main/docs/QUICKSTART.md#try-the-demo)\nfor a step-by-step walkthrough.\n\n## Commands\n\n### Analysis\n\n| Command | Description |\n|---------|-------------|\n| `report` | View IDOR detection report summary |\n| `chain` | Detect parameter chains with `--html` export and `--domains` filter |\n| `sequence` | API sequence diagram with `--html` export and ID highlighting |\n| `lifeline` | Show parameter lifespan analysis |\n| `score` | Risk-score IDOR candidates (critical / high / medium / low) |\n| `verify` | Interactive IDOR verification — send modified requests with user confirmation |\n| `auth` | Detect cross-user access patterns via auth context |\n| `diff` | Compare two reports and show changes |\n| `interactive` | Launch interactive mode with guided menus |\n\n### Configuration\n\n| Command | Description |\n|---------|-------------|\n| `config init` | Create default `idotaku.yaml` in the current directory |\n| `config show` | Show effective configuration (defaults + config file) |\n| `config get \u003ckey\u003e` | Get a single config value (supports dotted keys: `patterns.uuid`) |\n| `config set \u003ckey\u003e \u003cvalue\u003e` | Set a config value in the YAML file |\n| `config validate` | Validate config file syntax, types, and regex patterns |\n| `config path` | Print the path to the active config file |\n\nInteractive mode (`-i`) also provides a guided **setup wizard** for editing settings.\n\n### Import \u0026 Export\n\n| Command | Description |\n|---------|-------------|\n| `import-har` | Import HAR file and generate idotaku report |\n| `csv` | Export IDOR candidates or flows to CSV |\n| `sarif` | Export findings to SARIF 2.1.0 (GitHub Code Scanning) |\n\n## Programmatic API\n\n```python\nfrom idotaku.report import load_report, score_all_findings, diff_reports\nfrom idotaku.export import export_csv, export_sarif\nfrom idotaku.import_har import import_har\nfrom idotaku.verify import VerifyHttpClient, compare_responses, suggest_modifications\n\n# Load and score\ndata = load_report(\"report.json\")\nscored = score_all_findings(data.potential_idor)\n\n# Export\nexport_csv(\"idor.csv\", data, mode=\"idor\")\nexport_sarif(\"findings.sarif.json\", data)\n\n# Import HAR\nreport = import_har(\"capture.har\")\n\n# Diff two reports\ndiff = diff_reports(load_report(\"old.json\"), load_report(\"new.json\"))\n\n# Verification helpers\nsuggestions = suggest_modifications(\"12345\", \"numeric\")\n```\n\n## Use Cases\n\n### Bug Bounty Reconnaissance\nCapture traffic while browsing a target, then analyze the report to find IDs that appear in requests without a traceable origin. These are your first IDOR candidates to investigate.\n\n### Penetration Test Preparation\nBefore diving into manual testing, run idotaku to map the full ID landscape. The parameter chain analysis shows which API sequences share IDs — helping you prioritize where to test access controls.\n\n### CI/CD Security Gate\nImport HAR files from automated browser tests, generate a report, and export to SARIF. Integrate with GitHub Code Scanning to flag new IDOR candidates on every pull request.\n\n### Post-Capture Offline Analysis\nAlready have traffic from Burp, Chrome DevTools, or another proxy? Import the HAR file and analyze it without setting up mitmproxy.\n\n## Documentation\n\n- [Quick Start Guide](https://github.com/RalianENG/IDOR-otaku/blob/main/docs/QUICKSTART.md)\n- [Specification](https://github.com/RalianENG/IDOR-otaku/blob/main/docs/SPECIFICATION.md)\n- [Comparison with Other Tools](https://github.com/RalianENG/IDOR-otaku/blob/main/docs/COMPARISON.md)\n- [日本語 / Japanese README](https://github.com/RalianENG/IDOR-otaku/blob/main/docs/README_ja.md)\n\n## Contributing\n\n```bash\n# Clone and install with dev dependencies\ngit clone https://github.com/RalianENG/IDOR-otaku.git\ncd IDOR-otaku\npip install -e \".[dev]\"\n\n# Run tests\npytest\n\n# Run tests with coverage\npytest --cov=idotaku --cov-branch\n\n# Lint \u0026 type check\nruff check src/ tests/\nmypy src/idotaku/\n```\n\nBug reports and pull requests are welcome on [GitHub Issues](https://github.com/RalianENG/IDOR-otaku/issues).\n\n## Disclaimer\n\nThis tool is intended for **authorized security testing and educational purposes only**. You must obtain proper authorization before testing any systems you do not own. The authors are not responsible for any misuse or damage caused by this tool. Use at your own risk and in compliance with all applicable laws.\n\n## License\n\n[MIT](LICENSE)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fralianeng%2Fidor-otaku","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fralianeng%2Fidor-otaku","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fralianeng%2Fidor-otaku/lists"}