In this room, you're going to learn what an IDOR vulnerability is, what they look like, how to find them and a practical task exploiting a real case scenario.

What is an IDOR?

IDOR stands for Insecure Direct Object Reference and is a type of access control vulnerability.

This type of vulnerability can occur when a web server receives user-supplied input to retrieve objects (files, data, documents), too much trust has been placed on the input data, and it is not validated on the server-side to confirm the requested object belongs to the user requesting it.

Answer the questions below

  • What does IDOR stand for?

Insecure Direct Object Reference

  • What is the Flag from the IDOR example website?

THM{IDOR-VULN-FOUND}

  • What is a common type of encoding used by websites?

base64

  • What is a common algorithm used for hashing IDs?

md5

  • What is the minimum number of accounts you need to create to check for IDORs between accounts?

2

  • What is the username for user id 1?

adam84

  • What is the email address for user id 3?

j@fakemail.thm