vulns.cofield index
Enter
Contribute
Testing playbook · intermediate

IDOR & Broken Access Control

Systematically test whether one user can reach another user's objects or actions.

idorbacauthzowasp-a01
Stable IDplaybook:idor-huntingLast updatedLast verifiedLegacy review pendingProvenanceCurated workflow
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.

Every step requires authorization. Review side effects before running commands against a live system.

01

Map object references

Proxy the app and catalog every request carrying an ID, UUID, filename, or account reference.

Burp SuiteCaido
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
02

Set up two accounts

Create User A and User B. Capture A's requests, then replay them as B (swap session, keep A's object IDs).

Burp Suite
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
03

Swap and observe

Change IDs incrementally and via B's session. A 200 with A's data = IDOR. Test all verbs (GET/POST/PUT/DELETE).

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
04

Automate the sweep

For numeric IDs, script the range and diff response sizes/status to spot leaks.

ffuf -u https://target.com/api/orders/FUZZ -w <(seq 1000 2000) -H 'Cookie: session=USER_B' -mc 200
ffuf
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes

Common guidance

  • Don't ignore UUIDs - they leak in other responses more often than you'd think.
  • Test tenant boundaries and role escalation, not just user-to-user.
  • Blind writes matter too: a successful DELETE/PUT on another's object is high impact.
Related tools

Mapped workflow tools

ToolBurp SuiteToolCaidoToolffuf
Sources

References

Version history: normalized permanent page created 2026-08-20.