June 23, 2026
I Find IDOR Bugs in Minutes Using This Simple Manual Trick
Base Steps:

By SAYEM-EH
2 min read
Base Steps:
Testing for IDOR — ( Manual-Method ) :
1. Create two accounts if possible or else enumerate users first.
2. Check if the endpoint is private or public and does it contains any kind of id param.
3. Try changing the param value to some other user and see if does anything to their account.
4. Done !!1. Create two accounts if possible or else enumerate users first.
2. Check if the endpoint is private or public and does it contains any kind of id param.
3. Try changing the param value to some other user and see if does anything to their account.
4. Done !!Testcase — 1: Add IDs to requests that don't have them
GET /api/MyPictureList → /api/MyPictureList?user_id=<other_user_id>
Pro tip: You can find parameter names to try by deleting or editing other objects and seeing the parameter names used.GET /api/MyPictureList → /api/MyPictureList?user_id=<other_user_id>
Pro tip: You can find parameter names to try by deleting or editing other objects and seeing the parameter names used.Testcase — 2: Try replacing parameter names
Instead of this:
GET /api/albums?album_id=<album id>
Try This:
GET /api/albums?account_id=<account id>
Tip: There is a Burp extension called Paramalyzer which will help with this by remembering all the parameters you have passed to a host.Instead of this:
GET /api/albums?album_id=<album id>
Try This:
GET /api/albums?account_id=<account id>
Tip: There is a Burp extension called Paramalyzer which will help with this by remembering all the parameters you have passed to a host.Testcase — 3: Supply multiple values for the same parameter.
Instead of this:
GET /api/account?id=<your account id> →
Try this:
GET /api/account?id=<your account id>&id=<admin's account id>
Tip: This is known as HTTP parameter pollution. Something like this might get you access to the admin’s accountInstead of this:
GET /api/account?id=<your account id> →
Try this:
GET /api/account?id=<your account id>&id=<admin's account id>
Tip: This is known as HTTP parameter pollution. Something like this might get you access to the admin’s accountTestcase — 4: Try changing the HTTP request method when testing for IDORs
Instead of this:
POST /api/account?id=<your account id> →
Try this:
PUT /api/account?id=<your account id>
Tip: Try switching POST and PUT and see if you can upload something to another user’s profile. For RESTful services, try changing GET to POST/PUT/DELETE to discover create/update/delete actions.Instead of this:
POST /api/account?id=<your account id> →
Try this:
PUT /api/account?id=<your account id>
Tip: Try switching POST and PUT and see if you can upload something to another user’s profile. For RESTful services, try changing GET to POST/PUT/DELETE to discover create/update/delete actions.Testcase — 5: Try changing the request's content type
Instead of this:
POST /api/chat/join/123 \[…] Content-type: application/xml → testInstead of this:
POST /api/chat/join/123 \[…] Content-type: application/xml → testAnd
Try this:
POST /api/chat/join/123 \[…] Content-type: application/json {"user": "test"}Try this:
POST /api/chat/join/123 \[…] Content-type: application/json {"user": "test"}Tips:
Tip: Access controls may be inconsistently implemented across different content types. Don’t forget to try alternative and less common values like text/xml, text/x-json, and similar.Tip: Access controls may be inconsistently implemented across different content types. Don’t forget to try alternative and less common values like text/xml, text/x-json, and similar.Testcase — 6: Try changing the requested file type (Test if Ruby)
Example:
GET /user_data/2341 --> 401 Unauthorized
GET /user_data/2341.json --> 200 OK
Tip: Experiment by appending different file extensions (e.g. .json, .xml, .config) to the end of requests that reference a document.Example:
GET /user_data/2341 --> 401 Unauthorized
GET /user_data/2341.json --> 200 OK
Tip: Experiment by appending different file extensions (e.g. .json, .xml, .config) to the end of requests that reference a document.Testcase — 7: Does the app ask for non-numeric IDs? Use numeric IDs instead
There may be multiple ways of referencing objects in the database and the application only has access controls on one.
Try numeric IDs anywhere non-numeric IDs are accepted:
Example:
username=user1 → username=1234
account_id=7541A92F-0101-4D1E-BBB0-EB5032FE1686 → account_id=5678
album_id=MyPictures → album_id=12There may be multiple ways of referencing objects in the database and the application only has access controls on one.
Try numeric IDs anywhere non-numeric IDs are accepted:
Example:
username=user1 → username=1234
account_id=7541A92F-0101-4D1E-BBB0-EB5032FE1686 → account_id=5678
album_id=MyPictures → album_id=12Testcase — 8: Try using an array
If a regular ID replacement isn’t working, try wrapping the ID in an array and see if that does the trick. For example:
{“id”:19} → {“id”:[19]}If a regular ID replacement isn’t working, try wrapping the ID in an array and see if that does the trick. For example:
{“id”:19} → {“id”:[19]}Testcase — 9: Wildcard ID
These can be very exciting bugs to find in the wild and are so simple. Try replacing an ID with a wildcard. You might get lucky!
GET /api/users/<user_id>/ → GET /api/users/*These can be very exciting bugs to find in the wild and are so simple. Try replacing an ID with a wildcard. You might get lucky!
GET /api/users/<user_id>/ → GET /api/users/*Testcase — 10: Pay attention to new features
If you stumble upon a newly added feature within the web app, such as the ability to upload a profile picture for an upcoming charity event, and it performs an API call to:
/api/CharityEventFeb2021/user/pp/<ID>
It is possible that the application may not enforce access control for this new feature as strictly as it does for core features.If you stumble upon a newly added feature within the web app, such as the ability to upload a profile picture for an upcoming charity event, and it performs an API call to:
/api/CharityEventFeb2021/user/pp/<ID>
It is possible that the application may not enforce access control for this new feature as strictly as it does for core features.📚 10. Final Thoughts — Learn and Apply
If you stay consistent with this process, IDOR isn't about guessing IDs — it's about breaking trust in access control.Think beyond UI, and you'll start seeing real bugs everywhere.
Bug hunting is all about patience, persistence, and curiosity — keep learning and exploring, and the results will follow.
That's it for today! If you enjoyed this content, leave a clap, comment, and follow me for more guides.
Happy Hunting! 🏴☠️
— S4YEM.7KuroX
GoodBye