All Rooms
IDOR
easy20 mintryhackme
Learn about Insecure Direct Object Reference (IDOR) vulnerabilities — what they are, how to find them in encoded IDs, hashed IDs, and unpredictable IDs, and where they hide (URL parameters, AJAX requests, JavaScript). Includes a practical exercise exploiting an IDOR in an API endpoint to access other users' data by changing the user ID parameter.
Skills You Will Learn
idoraccess-controlapi-testingparameter-tampering
Prerequisites
- thm-authenticationbypass
- browser-devtools
Walkthrough Phases
1
Understanding IDOR
Learn what IDOR vulnerabilities are and why they're dangerous
2
Finding IDORs
Learn where IDOR vulnerabilities hide and how IDs are obfuscated
3
Practical IDOR Exploitation
Exploit a real IDOR vulnerability in an API endpoint