# Insecure Direct Object References (IDOR)

> Find and exploit IDOR and broken access control by tampering object references to reach other users' data and admin functionality.

- **URL:** https://hackindex.io/learn/oswa-web-200-study-path/insecure-direct-object-referencing
- **Certification:** [OSWA (WEB-200) Study Path](https://hackindex.io/learn/oswa-web-200-study-path.md)
- **Estimated study hours:** 1.5
- **Published:** 2026-09-26
- **Updated:** 2026-09-27

Insecure direct object reference (IDOR) is a broken access control flaw where an application exposes a reference to an internal object (a user ID, filename, or record key) and fails to verify the requester is authorized for it. Changing the reference grants access to other users' data or functionality. IDOR is a leading path to the OSWA objective: tampering an ID can leak an admin's local.txt, and vertical IDOR can reach administrative functions outright.

## IDOR and Access Control Discovery

Discovery focuses on parameters that reference objects: numeric IDs, UUIDs, hashes, and filenames in URLs, POST/PUT bodies, and API calls. Tampering a single value, enumerating a range, and diffing responses reveals unauthorized access. Broader access control testing checks vertical escalation (reaching admin functions as a normal user), horizontal escalation (reaching peers' data), and bypasses via HTTP method, Referer header, or multi-step flows.

## IDOR Exploitation

Exploitation turns a confirmed IDOR into impact: bulk horizontal extraction to scrape every user's records, write IDOR to modify other users' data, and vertical IDOR to invoke admin-only functionality. Parameter pollution can bypass weak authorization checks, and static file IDOR exposes documents and exports that were never meant to be reachable.

## Study material

- [IDOR Testing by Parameter Tampering](https://hackindex.io/services/web/vulnerability-discovery/idor-testing-by-parameter-tampering.md) (read, core)
- [Access Control Testing](https://hackindex.io/services/web/vulnerability-discovery/access-control-testing.md) (read, core)
- [IDOR Exploitation](https://hackindex.io/services/web/exploitation/idor-exploitation.md) (read, core)