🚪IDOR'S

What is an IDOR?

IDOR stands for Insecure Direct Object Reference and is a type of access control vulnerability.

you try changing the user_id value to 1000 instead (http://online-service.thm/profile?user_id=1000)

Hashed IDs

Hashed IDs are a little bit more complicated to deal with than encoded ones, but they may follow a predictable pattern, such as being the hashed version of the integer value.

It's worthwhile putting any discovered hashes through a web service such as https://crackstation.net/

This will pull any known Hashed IDs to quickly find the value.

Unpredictable IDs

If the Id cannot be detected using the above methods, an excellent method of IDOR detection is to create two accounts and swap the Id numbers between them. If you can view the other users' content using their Id number while still being logged in with a different account (or not logged in at all), you've found a valid IDOR vulnerability.

IDOR usually refers to an ID value allowing you to see accounts or information you shouldn’t. This is a fundamental and low-level understanding of IDOR. Some great software for finding IDORs is Burp Suit; you can find it here.