IDOR Vulnerability Analysis

Platform

PortSwigger Web Security Academy

Tools Used

• Burp Suite
• Browser Developer Tools
• HTTP Request Analysis

Vulnerability Type

IDOR (Insecure Direct Object Reference)

Objective

Access unauthorized user data by manipulating object references and analyze the security impact of broken access control.

Attack Flow

1. Login as a normal user
2. Intercept the HTTP request using Burp Suite
3. Identify the object reference (user ID / order ID / document ID)
4. Modify the parameter manually
5. Forward the modified request
6. Access unauthorized resource

Example

Original request:

GET /account?id=123

Modified request:

GET /account?id=124

Result:

Unauthorized access to another user's data

Impact

• Sensitive data exposure
• Privacy breach
• Unauthorized access
• Potential privilege escalation
• Broken access control exploitation

Risk Level

High

Mitigation

• Server-side authorization checks
• Access control validation
• Indirect object references
• Role-Based Access Control (RBAC)
• Principle of Least Privilege

Lessons Learned

Never trust client-side identifiers. Authorization must always be validated on the server side.