exploiting-idor-vulnerabilities

name	exploiting-idor-vulnerabilities
description	Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (numeric IDs, UUIDs, slugs) in API requests and URLs, using Burp Suite proxy history, Intruder, and the Authorize extension to test object-level authorization across sessions. Use during authorized penetration tests or bug bounty work to validate that CRUD endpoints and multi-tenant applications enforce per-object access control.
domain	cybersecurity
subdomain	web-application-security
tags	["penetration-testing","idor","access-control","owasp","burpsuite","web-security"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1505.003","T1083"]

Exploiting IDOR Vulnerabilities

When to Use

• During authorized penetration tests when testing access control on resource endpoints
• When APIs or web pages use predictable identifiers (numeric IDs, UUIDs, slugs) in URLs or request bodies
• For validating that object-level authorization is enforced across all CRUD operations
• When testing multi-tenant applications where users should only access their own data
• During bug bounty programs targeting broken access control vulnerabilities

Prerequisites

• Authorization: Written penetration testing agreement for the target application
• Burp Suite Professional: With Authorize extension installed from BApp Store
• Two test accounts: At least two separate user accounts with different permission levels
• Burp Authorize Extension: For automated IDOR testing across sessions
• curl/httpie: For manual request crafting
• Browser: Configured to proxy through Burp Suite

Workflow

Step 1: Map All Object References in the Application

Identify every endpoint that references objects by ID across the application.

# Browse the application through Burp proxy with User A
# Review Burp Target > Site Map for endpoints with object references

# Common IDOR-prone endpoints to look for:
# GET /api/users/{id}
# GET /api/orders/{id}
# GET /api/invoices/{id}/download
# PUT /api/users/{id}/profile
# DELETE /api/posts/{id}
# GET /api/documents/{id}
# GET /api/messages/{conversation_id}

# Extract all endpoints with IDs from Burp proxy history
# Burp > Proxy > HTTP History > Filter by target domain
# Look for patterns: /resource/123, ?id=123, {"user_id": 123}

# Check different ID formats:
# Numeric sequential: /users/101, /users/102
# UUID: /users/550e8400-e29b-41d4-a716-446655440000
# Base64 encoded: /users/MTAx (decodes to "101")
# Hashed: /users/5d41402abc4b2a76b9719d911017c592