>Home>Labs>New labs>Creators>Ranking>Learn>Business>Pricing
ES
Sign inCreate account
Home·Academy·Topics·idor
Topic · 3 articles

idor

Insecure Direct Object Reference: accessing other users' resources by changing an ID.

Quick answer

What is idor?

Insecure Direct Object Reference: accessing other users' resources by changing an ID.

Articles

3

Beginner

1

Intermediate

1

Advanced

1

Beginner level

1
Free

IDOR in a newsletter API — the UI hides it, the API hands it over

An endpoint with no server-side authorization check. A public parameter in the URL. Access to the subscriber list of any newsletter on a professional social network.

9 minidorbroken-access-controlapi
Read article

Intermediate level

1
Free

IDOR and BAC — manual methodology to find broken access control

How to identify IDOR (Insecure Direct Object Reference) and BAC (Broken Access Control) manually: dual-account testing, parameter swap, role escalation, hidden parameters.

14 minidorbacaccess-control
Read article

Advanced level

1
Free

Mass PII Extraction via GraphQL — 93 real profiles in 1 hour

A contact-sync GraphQL endpoint with no rate limiting, no ownership verification and batching of 200 numbers per request. Phone → real identity resolution.

13 mingraphqlenumerationpii
Read article

Practice idor with real labs

Apply the techniques in safe environments based on real bug bounty reports.

See idor labs
All topicsAcademy
hunters training
711

hunters training

labs from real reports
55

labs from real reports

completions
1,205

completions

in bounties practiced
$213,970

in bounties practiced

46 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy
BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free accountSee the labs

No card · free Academy · cancel anytime