IDOR & Broken Access Control
Accessing other users' resources by manipulating identifiers
Quick answer
What is IDOR & Broken Access Control?
An IDOR happens when the application uses a direct identifier to access resources without checking permissions. It's the most reported bug in bug bounty thanks to its simplicity and direct impact.
Severity
High
Frequency
Very common
Payloads
10
Steps
6
Severity
High
Frequency
Very common
Payloads
10
Broken Access Control (BAC) covers any failure in permission checks. IDOR is the most common subtype: manipulating an ID in the URL, body or header to access another user's data. It can be horizontal (same role, different user) or vertical (escalating to admin).
Where to look
IDs in API URLs
/api/users/{id}/profile, /api/orders/{id} — any endpoint with an identifier in the path.
IDs in the JSON body
POST/PUT requests with {"userId": "123"} or {"orderId": "456"} in the body.
File downloads
/download?file=invoice_123.pdf — change the number to access other users' invoices.
Deletion endpoints
DELETE /api/posts/{id} — if you can delete others' resources, it's critical.
'Secret' UUIDs
UUIDs aren't secret — many apps expose them in public lists, profiles or shared URLs.
Methodology
Create two test accounts
Account A (attacker) and Account B (victim). You need both to confirm the IDOR.
Perform an action with Account A
Capture the request with Burp/DevTools. Identify the resource ID in the URL, body or headers.
Swap the ID
Change Account A's ID for Account B's. Send the request.
Verify access
If you get Account B's data → IDOR confirmed. Compare the responses byte for byte.
Try variations
Change the HTTP method (GET→PUT→DELETE), try ID+1, ID-1, 0, arrays ["id"], string↔number type switches.
Escalate impact
IDOR on GET = information. IDOR on PUT = modification. IDOR on DELETE = destruction. Chain it with other bugs.
Real-world case
IDOR in a newsletter API — Subscriber enumeration
Endpoint discovery
The UI shows a 'View subscribers' button disabled for normal users, but the API has no restriction.
Identify the parameter
The /api/newsletter/subscribers endpoint accepts a public seriesUrn (visible in the newsletter URL).
Query without authorization
GET /api/newsletter/subscribers?urn={PUBLIC_URN} returns the full subscriber list.
Exposed data
Full names, companies, job titles and profile URLs of every subscriber.
Lesson: The UI can hide a button, but if the API doesn't validate permissions, the IDOR exists. Always test the endpoints directly, ignoring interface restrictions.
Payloads
Numeric ID +1
/api/v1/users/124/profile (tu ID es 123)
UUID swap
/api/v1/orders/a1b2c3d4-... → /api/v1/orders/e5f6g7h8-...
ID in body
PUT /api/settings {"userId": "OTRO_ID", "notifications": false}ID as query param
GET /api/invoices?user_id=OTRO_ID
ID in header
X-User-Id: OTRO_ID
Advanced payloads(account required)
HTTP method change
GET /api/users/123 → PUT /api/users/123 → DELETE /api/users/123
Mass Assignment + IDOR
PUT /api/users/OTRO_ID {"role": "admin", "email": "attacker@evil.com"}Array wrapping bypass
{"id": ["OTRO_ID"]} o {"id": {"$eq": "OTRO_ID"}}Encoding bypass
Base64(id), hex(id), URL-encode doble: %2531%2532%2533
Wildcard/glob
GET /api/users/*/profile o GET /api/users/../admin/settings
Exclusive content
Create your free account to access advanced payloads, scripts and bypass techniques
Create free accountTools
Autorize (Burp Extension)
Automatically compares requests with and without authorization to detect IDORs.
Burp → Extender → Autorize
IDOR with ffuf
Fuzz IDs to discover resources accessible without authorization.
ffuf -u 'https://target.com/api/users/FUZZ/profile' -w ids.txt -mc 200
Match & Replace (Burp)
Automates ID substitution across all requests for mass testing.
Proxy → Options → Match & Replace → Reemplazar tu ID por otro
Tips
UUIDs aren't secret
Many apps expose UUIDs in public responses: user lists, profiles, share URLs. Don't assume UUID = safe.
Always test DELETE
IDORs on destructive operations are more critical and often less protected than GETs.
Horizontal vs vertical IDOR
Horizontal: access another same-role user's data. Vertical: access admin functions as a normal user.
Chain IDORs
IDOR in profile (leak email) + IDOR in password reset = full Account Takeover.
Contenido relacionado
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice IDOR & Broken Access Control with real labs
Apply these techniques in safe environments based on real bug bounty reports.