Lab: Insecure direct object references
Summary: PortSwigger's Web Security Academy lab stores user chat logs as text files on the server's file system, retrieved through static URLs with filenames containing an incrementing number. The lab is solved by changing the transcript filename to 1.txt, reading a password found in that chat transcript, and logging in as the user carlos with the stolen credentials.
Bottom line: The entire compromise comes down to editing one number in a URL: a file named 1.txt exposes another user's chat transcript and the password inside it, with no other exploit required.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026