Testing for IDORs - Port Swigger
Summary: PortSwigger's guide describes Insecure Direct Object References (IDORs) as access control vulnerabilities where an application uses user-supplied input to reach files, directories, or database records directly, letting attackers manipulate those references to reach other objects without authorization. Its walkthrough uses the Web Security Academy lab where the URL shows id=wiener; a Sniper attack in Burp Intruder against that parameter returned 200 OK for /my-account?id=administrator and /my-account?id=carlos, confirming the vulnerability.
What's compelling: The entire test is changing one value in a URL - id=wiener to id=administrator - and a 200 OK response means another user's account page was retrieved without authorization.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026