IDOR Toolkit: Role Profiles and Access Matrix
Save login profiles for each role, such as admin, user and guest, and replay a request as every role at once. The access-control matrix shows who can access what, so IDOR and broken access control are easy to spot.
Access Control Testing, Without the Tab Juggling
Checking access control by hand means logging in as each role and sending the same request over and over. XHack does it in one go. Save a profile for each role you have a test account for, then replay one request as every role at once.
Profiles for Every Role
Open Repeater, click Profiles…, and save a profile per role, for example admin, user and guest, with that role's cookies or headers. Set them up once and reuse them across the whole engagement.
One Request, Every Role, One Matrix
Load a request, open Access matrix…, pick your profiles and click Run matrix. You get each role's response side by side. When a low-privilege role gets the same data as a high-privilege one, that points straight at IDOR or broken access control.
Let the AI Check It
The AI can use your saved profiles too. Just ask it to check access control with your roles, and it runs the comparisons for you.
Learn More
Try it on your own stack
Run this against a target you own and judge it on what it finds, not on a description.
Try XHack AIQuestions about this?
You get a researcher on the call, not a sales engineer reading the same page back to you.
Contact supportMore in XHack AI
Capabilities that sit alongside this one.