Insecure Direct Object References — Enumeration Basics
What Is IDOR?
Insecure Direct Object Reference (IDOR) is a class of broken access control vulnerability where an application exposes a reference to an internal object — such as a database row, file, or user record — and fails to verify that the requesting user is authorized to access that specific object.
IDOR is categorized under OWASP A01:2021 — Broken Access Control, the top-ranked vulnerability category in the OWASP Top 10.
Authentication vs. Authorization
A critical distinction underpins every IDOR vulnerability:
| Concept | Question answered | Example |
|---|---|---|
| Authentication | Who are you? | Is this a valid JWT for a known user? |
| Authorization | What are you allowed to access? | Does this JWT's sub match the profile ID requested? |
Many applications implement authentication correctly but omit object-level authorization. They confirm that a user is logged in, then return any record the user requests — regardless of ownership.
Sequential IDs and Enumeration
When applications use sequential integer IDs (1, 2, 3…) as direct object references, enumeration is trivial:
GET /api/v1/users/1/profile → returns user 1's data
GET /api/v1/users/2/profile → returns user 2's data
GET /api/v1/users/3/profile → returns user 3's data
...An authenticated attacker simply increments the ID and reads every record in the database.
Real-World IDOR Examples
- Facebook (2012): Security researcher Gurjeet Singh discovered that any authenticated user could delete any photo by referencing the photo's numeric ID directly. Reported through responsible disclosure.
- Instagram account takeover (2019): An IDOR in the account recovery flow allowed an attacker to reset any user's password by knowing their phone number, bypassing the rate limit through ID manipulation.
- Australian Taxation Office API (2020): An IDOR in the ATO's business portal exposed tax records for businesses other than the authenticated entity by incrementing the ABN reference in API calls.
What Is BOLA?
In API security, IDOR is often called BOLA — Broken Object Level Authorization. It is listed as API1:2023 in the OWASP API Security Top 10, reflecting its prevalence in API-driven architectures.
Lab Goal
In this lab you are authenticated as Alice (user ID 7). The API endpoint GET /api/v1/users/{id}/profile accepts any integer ID and returns that user's profile — no ownership check is performed.
Your objective: enumerate user IDs to find the admin profile and retrieve the CTF flag embedded in the admin's api_key field.
Proceed to the next step to begin.