Test for Insecure Direct Object References

This skill provides systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. It covers detection techniques using parameter manipulation and enumeration, exploitation via Burp Suite, and remediation strategies for securing applications against unauthorized access to both database object references and static file references.

Use this skill when conducting authorized security assessments of web applications that reference user-specific resources through IDs, filenames, or other parameters. It is essential for penetration testing engagements where you need to verify access control implementations across API endpoints, file downloads, and user data operations. Use it when you have at least two test accounts to verify cross-user access and written permission for security testing.

Do NOT use this skill without explicit authorization from the application owner. Do NOT use it to access, modify, or exfiltrate real user data in production environments. Use only for authorized security assessments with written permission.

You provide the target web application URL, at least two test user accounts for verification, an intercepting proxy tool like Burp Suite, written authorization for testing, and understanding of how the application references objects (IDs, filenames, GUIDs).

You receive an IDOR vulnerability report documenting discovered access control bypasses, proof of concept evidence showing unauthorized data access across user contexts, a list of affected API endpoints and parameters, impact assessment classifying data exposure severity, and specific remediation recommendations for identified vulnerabilities.

Burp Suite serves as the primary intercepting proxy for request manipulation, manual exploitation, and automated enumeration using the Intruder tool. The skill works with any web application that uses user-controllable parameters to reference resources, including REST APIs, file download endpoints, and query parameter-based systems.

This skill is designed for penetration testers, security researchers, and application security engineers who need to validate access control implementations in web applications. It serves teams conducting security assessments where horizontal privilege escalation (user-to-user access) and vertical privilege escalation (user-to-admin access) must be tested systematically.

Here is a concrete example of URL parameter manipulation testing:

# Step 1: Capture original authenticated request
GET /api/user/profile?id=1001 HTTP/1.1
Cookie: session=attacker_session

# Step 2: Modify ID to target another user
GET /api/user/profile?id=1000 HTTP/1.1
Cookie: session=attacker_session

# Vulnerable if: Returns victim's data with attacker's session

The skill includes comprehensive testing checklists covering increment/decrement ID tests, victim ID substitution, range enumeration (1-1000), negative values, large values, string ID format changes, and GUID manipulation. It provides response analysis guidance for interpreting 200 OK, 403 Forbidden, 404 Not Found, 401 Unauthorized, and 500 Error status codes in the context of IDOR testing.