Testing for IDOR
Allowing unauthorized direct access to files or resources on a system based on user-supplied input is known as IDOR. This vulnerability allows us to bypass authorization checks placed on such files or resources. IDOR is a result of unchecked user-supplied input to retrieve an object without performing authorization checks in the application code.
Getting ready
Let’s use the Insecure direct object references PortSwigger lab, which is located in the Access control section of All labs, as our target application. We will attempt to find a direct object reference used as a value to a parameter, manipulate it, and access information that should normally not be seen.
Log in to your PortSwigger account and navigate to the following URL: https://portswigger.net/web-security/access-control/lab-insecure-direct-object-references. Ensure Burp Suite is running and sending traffic through either Firefox or the Burp Suite browser.
How to do it...
- From the...
