> For the complete documentation index, see [llms.txt](https://notes.sfoffo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.sfoffo.com/web-applications/web-attacks/insecure-direct-object-references-idor.md).

# Insecure Direct Object References (IDOR)

## **Introduction**

> * IDOR refers to the ability to interact directly with object by using a reference to their identifier
> * An example of IDOR is whenever a web application uses a guessable id value that can be directly modified by the user (e.g. an id in the URL)
> * As web applications store users' files and information, they may use sequential numbers or user IDs to identify each item.
> * IDOR can lead to accessing data that should not be accessible by attackers.
> * What makes this attack very common is essentially the lack of a solid access control system on the back-end.
> * IDOR *"becomes"* BROKEN ACCESS CONTROL whenever a user can access other objects which he doesn't have permissions for (e.g. other user's data or admin data)

***

## **Detecting potential IDOR Vulnerabilities**

1. Example: `GET` request with a specific reference to an object by using `?id=NUMBER`
2. Example: `POST` request with a specific reference (in its body) to an object by using `?id=NUMBER`
3. Example: `POST` request with specific user-permissions-related parameters such as `user role o permissions` or `"url":"/abc/data/users/1"`