Skip to content
HackIndex.io

OSWA · Module 14

Insecure Direct Object References (IDOR)

Find and exploit IDOR and broken access control by tampering object references to reach other users' data and admin functionality.

~1.5 h 3 resources Last updated September 27, 2026

Insecure direct object reference (IDOR) is a broken access control flaw where an application exposes a reference to an internal object (a user ID, filename, or record key) and fails to verify the requester is authorized for it. Changing the reference grants access to other users' data or functionality. IDOR is a leading path to the OSWA objective: tampering an ID can leak an admin's local.txt, and vertical IDOR can reach administrative functions outright.

IDOR and Access Control Discovery

Discovery focuses on parameters that reference objects: numeric IDs, UUIDs, hashes, and filenames in URLs, POST/PUT bodies, and API calls. Tampering a single value, enumerating a range, and diffing responses reveals unauthorized access. Broader access control testing checks vertical escalation (reaching admin functions as a normal user), horizontal escalation (reaching peers' data), and bypasses via HTTP method, Referer header, or multi-step flows.

IDOR Exploitation

Exploitation turns a confirmed IDOR into impact: bulk horizontal extraction to scrape every user's records, write IDOR to modify other users' data, and vertical IDOR to invoke admin-only functionality. Parameter pollution can bypass weak authorization checks, and static file IDOR exposes documents and exports that were never meant to be reachable.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Practice

Apply the module hands-on.

All OSWA practice machines