Web Application Hacking (Hands-On)
Broken Access Control / IDOR — Concept + Live Lab
Access other users' data just by changing an ID. Extremely common.
Open the interactive lesson & lab →
Insecure Direct Object Reference (IDOR) is a form of broken access control: the app uses a predictable identifier (like ?id=3) and forgets to check whether YOU are allowed to see that object.
You're user 3, viewing your invoice at /invoice/3. What happens if you request /invoice/1? If the server returns it without checking ownership, that's IDOR — you just read someone else's data.
How to hunt it
- Look for numeric or guessable IDs in URLs, parameters, and API calls.
- Increment/decrement them (3 → 1, 3 → 4) and watch the response.
- Try IDs, UUIDs from other accounts, and hidden form fields.
- Test every HTTP method — a GET might be protected while DELETE isn't.