How Find IDOR & Broken Access Control Bugs: Using Endpoints Found From JS Files

In the last article, we saw how to pull endpoints out of JS files. Today we'll look at how to use those endpoints to find IDOR (Insecure Direct Object Reference) and Broken Access Control (BAC) bugs.

Both of these bugs are great for beginners because you don't need advanced skills to find them just patience and a systematic approach.

What's the difference between IDOR and Broken Access Control?

• IDOR: When a user changes an ID (like user_id, order_id, invoice_id) and ends up accessing someone else's data.
• Broken Access Control: When a user steps outside their role and performs an action that should only be allowed for an admin or a higher-privilege user.

The core issue in both is the same — the server doesn't properly check whether the person sending the request is actually allowed to access that data/action.

Step 1: Create two accounts very important

To find IDOR, we need at least 2 test accounts — at the same privilege level (both normal users, for example)…