All labs › IDOR

🚪 IDOR

Change the identifier, get somebody else's data. Highest paying class in bug bounty, and the one most often left in by accident.

14 labs and targetsfree, no accountlesson included

How broken access control actually works — taught by The XSS Rat

What it is

Authentication is who you are; authorisation is what you are allowed to touch. Broken access control is the app checking the first and forgetting the second, so an object id, a role field or a hidden admin route is all that stands between you and someone else's data.

How I attack it

Make two accounts. Do everything as A, then replay A's requests with B's session and see what comes back.
Change the identifier, then change the method, then change the content type. Many apps only guard the happy path.
Hunt the functions nobody links to: admin routes in the JS bundle, old API versions, export and print endpoints.
A 403 on the UI route means nothing if the API behind it answers. Always test the API directly.

Learn it from The XSS Rat

▶ Watch: IDOR on YouTube ✍ Read: idor on Medium 🎓 Course: BAC and IDOR Guide

Free reference reading

PortSwigger Academy: access control PortSwigger Academy: IDOR HackTricks: IDOR OWASP: authorization cheat sheet

The numbered set 4

Same blog application four times, each one hiding the id a little better.

IDOR 1

Simple and straightforward. Identify and exploit the easiest token.

IDOR 2

Slightly obfuscated endpoint but still manageable. Pay attention to the requests.

IDOR 3

More complex endpoint structure. Analyze and experiment carefully.

IDOR 4

Advanced endpoint obfuscation. Think creatively and use all tools at your disposal.

Identifiers that are not numbers 3

UUID labs

Numeric ids replaced by UUIDs. Find where the UUID leaks before you try to guess one.

Application

RatBook

Social network mimic. View, edit and delete posts that are not yours.

Application

CheeseBlog (UUID)

The blog again, keyed on UUIDs end to end.

Beyond the GET parameter 7

POST actions

The id travels in the body. Same bug, different place to look.

POST actions 01

Warm-up: the body field nobody validates.

POST actions 02

Now with a check that looks right and is not.

POST actions 03

Two requests, one of which trusts the other.

Second order IDOR

Nothing happens when you send it. Something happens later, somewhere else.

Application

Theme Park IDOR

Bookings belonging to other visitors.

Off-site

JS-driven IDOR

The ids are built in the front end. Read the bundle.

Also here 3

Community write-up IDOR + CSRF write-up Video walkthrough

Nothing matches thatClear the filter to see everything again.