Lab · Easy-Intermediate · 15 min Solved
IDOR (wrong object access)
Change an id in a fake API and read someone else's note. The bug is missing an ownership check.
1) The idea
The app asks for note #1001 and returns it without asking “does this user own it?”. Guessing nearby ids leaks others' data.
2) Try it
Your notes are 1001 and 1002. Try 1003.
Hint 1
Ids often go up by one.
Hint 2
Request id 1003.
3) The fix
On every request, check the signed-in user owns the object (or has a role). Use unguessable ids as defense-in-depth, not as the only control. Add tests for cross-user access.
Simulated tools. They can only act on this lab's fake target inside the sandbox — there is no target field, no network, and nothing leaves your browser.
ID enumeratorWalks nearby note ids on the fake API and flags objects you do not own.
$ idor-sim --range 1000-1005
Recon (headers & forms)Lists the fake target's simulated headers and input fields.
$ recon-sim
Real scanners against real sites without permission are illegal. Use these ideas only on systems you own or are authorized to test.