IDORs: What are they and how do you test for them?

6 min readNov 26, 2020

What is it

IDOR: Insecure Direct Object Reference

Photo by Muhannad Ajjan on Unsplash

These types of vulnerabilities arise from acces control issues. We will devote another entire chapter to those types of vulnerabilities. The term IDOR was made popular in by appearing in the OWASP top 10 but in reality it’s simply another type of Broken Access Control issue. IDORs can manifest in both horizontal and vertical privilege escalation. To speak of an IDOR, the following conditions have to be met:

  • An object identifier exists in the request, either as GET or POST parameter
  • A Broken Access Control issue has to exist allowing the user access to data they should not be able to access

These terms may seem abstract so let’s look at an example:

  • GET /invoice.php?id=12
  • POST /personalInfo.php


  • GET /invoices/1234.txt

In these examples we can see a POST and a GET request being made, both contain an identifier. In a normal situation, the user can only access invoices or personal data that belong to them. If we however change this identifier and get data returned that does not belong to our user, we have an IDOR.




No b*llshit Hacking tutorials with extreme value in short bursts