IDOR - Insecure Direct Object Reference
Beginner
A01:2021 - Access Control
100 points
Challenge Description
This employee portal uses sequential numeric IDs to reference user profiles, documents, and orders. The application doesn't verify that the currently logged-in user has permission to access the requested resource.
You are logged in as user ID 1004. Your goal is to access the admin user's profile (ID 1001) to find the secret flag.
Learning Objective: Understand how IDOR vulnerabilities allow unauthorized access to other users' data through predictable identifiers.
Your Session:
User ID:
Your Resources: Profile #1004, Documents: #103, Orders: #5003
User ID:
1004Your Resources: Profile #1004, Documents: #103, Orders: #5003
View User Profile (Vulnerable)
Profile ID:
Request: GET /api/users/1004View Document (Vulnerable)
Document ID:
Request: GET /api/documents/103View Order (Vulnerable)
Order ID:
Request: GET /api/orders/5003Submit Flag
Hints
-10% per hint
ID Scanner
Scan a range of profile IDs: