Web Hacking for Pentesters: IDOR and Broken Object Access

IDOR is the classic 'change the number in the URL' bug, but it also lives in POST bodies, GraphQL IDs, and export jobs. UUIDs spread false confidence—authorization still must bind objects to users.

It's one of the first tests I run after mapping two same-tier accounts.

IDOR testing is repetitive by design—swap identifiers methodically and you'll find bugs that random fuzzing never prioritizes.

Patterns beyond URLs

File downloads, invoice PDFs, messaging threads, shared links with weak tokens, and batch APIs returning mixed ownership.

Mobile apps often hide endpoints web proxies still see.

Methodical checks

Swap identifiers between user A and B. Note write vs read vs delete. Check unauthenticated access to 'secret' links.

• Compare response sizes and ETags

• Test archived vs active objects

• Document minimal cross-user proof

Remediation

Server-side ownership checks on every object touch, indirect references for clients, and logging denied access.

Access bugs are high impact—handle proof data carefully.

Never access real customer records outside test accounts.

When IDs are opaque, test references in exports, emails, and notifications—users leak identifiers without knowing.

Small habits compound—what feels like overhead early becomes speed when deadlines hit.

Test file names and UUIDs in webhook callbacks—not just REST paths.

Reference tokens

Opaque tokens and HMAC URLs still need authorization—don't assume unguessable means secure.

Check export and async download endpoints hours later; jobs sometimes skip checks present on live API.

UUID enumeration myths

Bulk export endpoints defeat UUID secrecy—always test download and async job IDs.

Horizontal access between same-role users is still critical even if vertical admin escape fails.

Recommend audit logs on denied object access for high-value resources.

---

Worth reading next

API Hacking: Broken Object Level Authorization (BOLA)

Business Logic Flaws and Broken Access Control

Bug Bounty: How to Write a Vulnerability Report