{"id":15634,"date":"2021-08-05T16:29:33","date_gmt":"2021-08-05T10:59:33","guid":{"rendered":"https:\/\/www.varutra.com\/?p=15634"},"modified":"2022-12-02T12:25:25","modified_gmt":"2022-12-02T06:55:25","slug":"insecure-direct-object-reference-idor","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/","title":{"rendered":"Insecure Direct Object Reference (IDOR)"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1080\" src=\"https:\/\/varutra-1a3b6.kxcdn.com\/wp-content\/uploads\/2021\/08\/IDOR-1024x573.png\"  class=\"sh-overlay-item sh-table-cell ls-is-cached lazyloaded\" data-rel=\"lightcase\" title=\"IDOR - Varutra Consulting\"><\/p>\n<h3><strong>What is an Insecure Direct Object Reference (IDOR) Risk?<\/strong><\/h3>\n<p><strong>\u00a0<\/strong>IDOR stands for <strong>Insecure Direct Object Reference <\/strong>occurring when an application displays an indication of an internal object in an unsafe manner. Whenever a user generates, sends an <a href=\"https:\/\/www.varutra.com\/http-request-smuggling\/\">HTTP request<\/a>, or receives a request from a server, there are parameters such as \u201cID\u201d, \u201cUID\u201d, \u201cPID\u201d etc. that have certain unique values that the user has been assigned. An attacker may detect such parameter values in HTTP paths, cookies, and headers. With this, the attacker can tamper with other privileges of user data and this interference can lead to Insecure Direct Object Reference Vulnerability.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-15638 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/IDOR-Flow.png\" alt=\"Insecure Direct Object Reference (IDOR) Vulnerability Flow\" width=\"565\" height=\"231\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/IDOR-Flow.png 565w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/IDOR-Flow-300x123.png 300w\" sizes=\"(max-width: 565px) 100vw, 565px\" \/><\/p>\n<p style=\"text-align: center\"><strong>Figure 1: IDOR Flow<\/strong><\/p>\n<p>&nbsp;<\/p>\n<h3><strong>What are HTTP methods and what are they used for?<\/strong><\/h3>\n<p>HTTP defines a set of request methods to indicate the desired action to be used for a given service. In simple terms &#8220;It is a method of communication between server-side and client-side&#8221;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-15637 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/HTTP-Methods.png\" alt=\"HTTP Methods\" width=\"568\" height=\"163\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/HTTP-Methods.png 568w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/HTTP-Methods-300x86.png 300w\" sizes=\"(max-width: 568px) 100vw, 568px\" \/><\/p>\n<p style=\"text-align: center\"><strong>Figure 1.1: HTTP Methods<\/strong><\/p>\n<p>In general, Insecure Direct Object Reference (IDOR) has three types of attack vectors:<\/p>\n<ul>\n<li><strong>Body Manipulation<\/strong>. Attackers can change the value of the input box, radio buttons, and form fields. This allows them to access other users&#8217; information more easily.<\/li>\n<li><strong>URL Tampering<\/strong>. The URL is changed at the client-side by tempering parameters on the HTTP request. HTTP GET and POST actions are often at risk of URL tampering attacks that lead to IDOR attacks in applications.<\/li>\n<li><strong>JSON IDs manipulation<\/strong>.\n<ul>\n<li>APIs and small services that will work with a structured data format like JSON may be vulnerable to IDOR flaws and errors.<\/li>\n<li>To read other users&#8217; data, especially if they rely on some obvious form of a session to validate applications.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Here we can see how Insecure Direct Object Reference (IDOR) works in the modern web application, we test PortSwigger lab for this attack.<\/p>\n<p>This is the official URL: <a href=\"https:\/\/acc91f8f1f83a99b805b1001001c0052.web-security-academy.net\">https:\/\/acc91f8f1f83a99b805b1001001c0052.web-security-academy.net<\/a> to access the lab.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-15639 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/IDOR-works-in-the-modern-web-application.png\" alt=\"Insecure Direct Object Reference works in the modern web application\" width=\"545\" height=\"352\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/IDOR-works-in-the-modern-web-application.png 545w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/IDOR-works-in-the-modern-web-application-300x194.png 300w\" sizes=\"(max-width: 545px) 100vw, 545px\" \/><\/p>\n<p>For solving this lab, we need to get the password of CARLOS via IDOR vulnerability.<\/p>\n<p>&nbsp;<\/p>\n<ol>\n<li><strong>Click on the live chat button.<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15641 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/1.-Click-on-live-chat-button..png\" alt=\"Click on live chat button.\" width=\"559\" height=\"236\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/1.-Click-on-live-chat-button..png 559w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/1.-Click-on-live-chat-button.-300x127.png 300w\" sizes=\"(max-width: 559px) 100vw, 559px\" \/><\/p>\n<ol start=\"2\">\n<li><strong>Click on the send button and observe messages.<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15642 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/2.-Click-on-send-button-and-observe-messages..png\" alt=\"Click on send button and observe messages.\" width=\"558\" height=\"236\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/2.-Click-on-send-button-and-observe-messages..png 558w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/2.-Click-on-send-button-and-observe-messages.-300x127.png 300w\" sizes=\"(max-width: 558px) 100vw, 558px\" \/><\/p>\n<ol start=\"3\">\n<li><strong>Click on view transcript and capture the request in Burpsuite.<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15643 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/3.-Click-on-view-transcript-and-capture-the-request-in-Burpsuite.png\" alt=\"Click on view transcript and capture the request in Burpsuite\" width=\"558\" height=\"245\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/3.-Click-on-view-transcript-and-capture-the-request-in-Burpsuite.png 558w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/3.-Click-on-view-transcript-and-capture-the-request-in-Burpsuite-300x132.png 300w\" sizes=\"(max-width: 558px) 100vw, 558px\" \/><\/p>\n<ol start=\"4\">\n<li><strong>Forward this request.<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15644 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/4.-Forward-this-request..png\" alt=\"Forward this request.\" width=\"559\" height=\"215\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/4.-Forward-this-request..png 559w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/4.-Forward-this-request.-300x115.png 300w\" sizes=\"(max-width: 559px) 100vw, 559px\" \/><\/p>\n<ol start=\"5\">\n<li><strong>After forward we will get this endpoint path \/download-transcript\/3.txt<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15640 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/5.-After-forward-we-will-get-this-endpoint-path-download-transcript-txt.png\" alt=\"After forward we will get this endpoint path download-transcript txt\" width=\"560\" height=\"279\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/5.-After-forward-we-will-get-this-endpoint-path-download-transcript-txt.png 560w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/5.-After-forward-we-will-get-this-endpoint-path-download-transcript-txt-300x149.png 300w\" sizes=\"(max-width: 560px) 100vw, 560px\" \/><\/p>\n<ol start=\"6\">\n<li><strong>Change the endpoint path 3.txt to 1.txt and forward it.<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15647 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/6.-Change-the-endpoint-path-3.txt-to-1.txt-and-forward-it..png\" alt=\"Change the endpoint path 3.txt to 1.txt and forward it.\" width=\"559\" height=\"275\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/6.-Change-the-endpoint-path-3.txt-to-1.txt-and-forward-it..png 559w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/6.-Change-the-endpoint-path-3.txt-to-1.txt-and-forward-it.-300x148.png 300w\" sizes=\"(max-width: 559px) 100vw, 559px\" \/><\/p>\n<ol start=\"7\">\n<li><strong>Now as we can see we are successfully able to download the 1.txt file of CARLOS.<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15648 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/7.-Now-as-we-can-see-we-are-successfully-able-to-download-the-1.txt-file-of-CARLOS..png\" alt=\"Now as we can see we are successfully able to download the 1.txt file of CARLOS.\" width=\"560\" height=\"289\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/7.-Now-as-we-can-see-we-are-successfully-able-to-download-the-1.txt-file-of-CARLOS..png 560w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/7.-Now-as-we-can-see-we-are-successfully-able-to-download-the-1.txt-file-of-CARLOS.-300x155.png 300w\" sizes=\"(max-width: 560px) 100vw, 560px\" \/><\/p>\n<ol start=\"8\">\n<li><strong>Open this txt file and we can see the CARLOS password in it.<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15649 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/8.-Open-this-txt-file-and-we-can-see-the-CARLOS-password-in-it..png\" alt=\"Open this txt file and we can see the CARLOS password in it.\" width=\"559\" height=\"280\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/8.-Open-this-txt-file-and-we-can-see-the-CARLOS-password-in-it..png 559w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/8.-Open-this-txt-file-and-we-can-see-the-CARLOS-password-in-it.-300x150.png 300w\" sizes=\"(max-width: 559px) 100vw, 559px\" \/><\/p>\n<ol start=\"9\">\n<li><strong>Now try to login with CARLOS account using this password.<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15650 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/9.-Now-try-to-login-with-CARLOS-account-using-this-password..png\" alt=\"Now try to login with CARLOS account using this password.\" width=\"560\" height=\"206\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/9.-Now-try-to-login-with-CARLOS-account-using-this-password..png 560w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/9.-Now-try-to-login-with-CARLOS-account-using-this-password.-300x110.png 300w\" sizes=\"(max-width: 560px) 100vw, 560px\" \/><\/p>\n<ol start=\"10\">\n<li><strong>As you can see, I am successfully able to login into the CARLOS account and solved the challenge.<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-15646 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/10.-As-you-can-see-I-am-successfully-able-to-login-into-the-CARLOS-account-and-solved-the-challenge..png\" alt=\"As you can see, I am successfully able to login into the CARLOS account and solved the challenge.\" width=\"558\" height=\"273\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/10.-As-you-can-see-I-am-successfully-able-to-login-into-the-CARLOS-account-and-solved-the-challenge..png 558w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/10.-As-you-can-see-I-am-successfully-able-to-login-into-the-CARLOS-account-and-solved-the-challenge.-300x147.png 300w\" sizes=\"(max-width: 558px) 100vw, 558px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h3><strong>Impact of the Insecure Direct Object Reference Vulnerability:<\/strong><\/h3>\n<ul>\n<li>As a result of this vulnerability, attackers can bypass authorization and access resources in the system directly, for example, database records or files.<\/li>\n<li>Such resources can be database entries belonging to other users, files in the system, etc.<\/li>\n<li>An attacker can steal sensitive information from unrestricted directories and use this to craft other attacks.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3><strong>Mitigation of the Insecure Direct Object Reference Vulnerability:<\/strong><strong>\u00a0<\/strong><\/h3>\n<ul>\n<li>Engineers should avoid showing references to secret objects such as keys or file names.<\/li>\n<li>Parameter validation should be used correctly.<\/li>\n<li>Verification of all indicated items must be done and implement Authentication\/Authorization in the application.<\/li>\n<li>Tokens should be generated in such a way that they should be edited to the user only and should not be public.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><strong>References:<\/strong><strong>\u00a0<\/strong><\/p>\n<ul>\n<li><a href=\"https:\/\/portswigger.net\/web-security\/access-control\/idor\">https:\/\/portswigger.net\/web-security\/access-control\/idor<\/a><\/li>\n<li><a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html\">https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html<\/a><\/li>\n<\/ul>\n<p><strong>\u00a0<\/strong><\/p>\n<p>Author,<\/p>\n<p><strong>Rituraj Vishwakarma<\/strong><\/p>\n<p>Attack &amp; PenTest Team<\/p>\n<p>Varutra Consulting Pvt. Ltd<\/p>","protected":false},"excerpt":{"rendered":"<p>What is an Insecure Direct Object Reference (IDOR) Risk? \u00a0IDOR stands for Insecure Direct Object Reference occurring when an application displays an indication of an&#8230;<\/p>\n","protected":false},"author":4,"featured_media":15654,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[272],"tags":[482,481,480,341,435],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 4.6.3 - aioseo.com -->\n\t\t<meta name=\"description\" content=\"Insecure Direct Object Reference (IDOR) vulnerability occurs when an application displays an indication of an internal object in an unsafe manner.\" \/>\n\t\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t\t<link rel=\"canonical\" href=\"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 4.6.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Varutra Consulting\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Insecure Direct Object Reference (IDOR) vulnerability\" \/>\n\t\t<meta property=\"og:description\" content=\"Insecure Direct Object Reference (IDOR) vulnerability occurs when an application displays an indication of an internal object in an unsafe manner.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/IDOR.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/IDOR.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1060\" \/>\n\t\t<meta property=\"og:image:height\" content=\"593\" \/>\n\t\t<meta property=\"article:section\" content=\"Web Application Security\" \/>\n\t\t<meta property=\"article:tag\" content=\"appsecurity\" \/>\n\t\t<meta property=\"article:tag\" content=\"idor\" \/>\n\t\t<meta property=\"article:tag\" content=\"insecure direct object reference\" \/>\n\t\t<meta property=\"article:tag\" content=\"web application security\" \/>\n\t\t<meta property=\"article:tag\" content=\"web security\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-08-05T10:59:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-12-02T06:55:25+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Insecure Direct Object Reference (IDOR) vulnerability\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Insecure Direct Object Reference (IDOR) vulnerability occurs when an application displays an indication of an internal object in an unsafe manner.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/IDOR.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"kalpblogger\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#article\",\"name\":\"Insecure Direct Object Reference (IDOR) vulnerability\",\"headline\":\"Insecure Direct Object Reference (IDOR)\",\"author\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/IDOR.png\",\"width\":1060,\"height\":593,\"caption\":\"Insecure Direct Object Reference (IDOR)\"},\"datePublished\":\"2021-08-05T16:29:33+05:30\",\"dateModified\":\"2022-12-02T12:25:25+05:30\",\"inLanguage\":\"en-US\",\"commentCount\":1,\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#webpage\"},\"articleSection\":\"Web Application Security, appsecurity, IDOR, Insecure Direct Object Reference, web application security, web security\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"nextItem\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#listItem\"},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#listItem\",\"position\":2,\"name\":\"Insecure Direct Object Reference (IDOR)\",\"previousItem\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#listItem\"}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\",\"name\":\"Varutra\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/Varutra-Found-e1612984024606.jpg\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/\",\"name\":\"kalpblogger\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5e96a9b330da7c941c1e39217a2fbe38?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"kalpblogger\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#webpage\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/\",\"name\":\"Insecure Direct Object Reference (IDOR) vulnerability\",\"description\":\"Insecure Direct Object Reference (IDOR) vulnerability occurs when an application displays an indication of an internal object in an unsafe manner.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/wp-content\\\/uploads\\\/2021\\\/08\\\/IDOR.png\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#mainImage\",\"width\":1060,\"height\":593,\"caption\":\"Insecure Direct Object Reference (IDOR)\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/insecure-direct-object-reference-idor\\\/#mainImage\"},\"datePublished\":\"2021-08-05T16:29:33+05:30\",\"dateModified\":\"2022-12-02T12:25:25+05:30\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#website\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"name\":\"Varutra Consulting\",\"description\":\"Secure your digital world with our Cybersecurity services.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Insecure Direct Object Reference (IDOR) vulnerability<\/title>\n\n","aioseo_head_json":{"title":"Insecure Direct Object Reference (IDOR) vulnerability","description":"Insecure Direct Object Reference (IDOR) vulnerability occurs when an application displays an indication of an internal object in an unsafe manner.","canonical_url":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"og:locale":"en_US","og:site_name":"Varutra Consulting","og:type":"article","og:title":"Insecure Direct Object Reference (IDOR) vulnerability","og:description":"Insecure Direct Object Reference (IDOR) vulnerability occurs when an application displays an indication of an internal object in an unsafe manner.","og:url":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/","og:image":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/IDOR.png","og:image:secure_url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/IDOR.png","og:image:width":"1060","og:image:height":"593","article:section":"Web Application Security","article:tag":["appsecurity","idor","insecure direct object reference","web application security","web security"],"article:published_time":"2021-08-05T10:59:33+00:00","article:modified_time":"2022-12-02T06:55:25+00:00","twitter:card":"summary_large_image","twitter:title":"Insecure Direct Object Reference (IDOR) vulnerability","twitter:description":"Insecure Direct Object Reference (IDOR) vulnerability occurs when an application displays an indication of an internal object in an unsafe manner.","twitter:image":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/IDOR.png","twitter:label1":"Written by","twitter:data1":"kalpblogger","twitter:label2":"Est. reading time","twitter:data2":"3 minutes","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#article","name":"Insecure Direct Object Reference (IDOR) vulnerability","headline":"Insecure Direct Object Reference (IDOR)","author":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"publisher":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/IDOR.png","width":1060,"height":593,"caption":"Insecure Direct Object Reference (IDOR)"},"datePublished":"2021-08-05T16:29:33+05:30","dateModified":"2022-12-02T12:25:25+05:30","inLanguage":"en-US","commentCount":1,"mainEntityOfPage":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#webpage"},"isPartOf":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#webpage"},"articleSection":"Web Application Security, appsecurity, IDOR, Insecure Direct Object Reference, web application security, web security"},{"@type":"BreadcrumbList","@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/#listItem","position":1,"name":"Home","item":"https:\/\/www.varutra.com\/varutravrt3\/","nextItem":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#listItem"},{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#listItem","position":2,"name":"Insecure Direct Object Reference (IDOR)","previousItem":"https:\/\/www.varutra.com\/varutravrt3\/#listItem"}]},{"@type":"Organization","@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization","name":"Varutra","url":"https:\/\/www.varutra.com\/varutravrt3\/","logo":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/11\/Varutra-Found-e1612984024606.jpg","@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#organizationLogo"},"image":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author","url":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/","name":"kalpblogger","image":{"@type":"ImageObject","@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/5e96a9b330da7c941c1e39217a2fbe38?s=96&d=mm&r=g","width":96,"height":96,"caption":"kalpblogger"}},{"@type":"WebPage","@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#webpage","url":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/","name":"Insecure Direct Object Reference (IDOR) vulnerability","description":"Insecure Direct Object Reference (IDOR) vulnerability occurs when an application displays an indication of an internal object in an unsafe manner.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#website"},"breadcrumb":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#breadcrumblist"},"author":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"creator":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/08\/IDOR.png","@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#mainImage","width":1060,"height":593,"caption":"Insecure Direct Object Reference (IDOR)"},"primaryImageOfPage":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/#mainImage"},"datePublished":"2021-08-05T16:29:33+05:30","dateModified":"2022-12-02T12:25:25+05:30"},{"@type":"WebSite","@id":"https:\/\/www.varutra.com\/varutravrt3\/#website","url":"https:\/\/www.varutra.com\/varutravrt3\/","name":"Varutra Consulting","description":"Secure your digital world with our Cybersecurity services.","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization"}}]}},"aioseo_meta_data":{"post_id":"15634","title":"Insecure Direct Object Reference (IDOR) vulnerability","description":"Insecure Direct Object Reference (IDOR) vulnerability occurs when an application displays an indication of an internal object in an unsafe manner.","keywords":[],"keyphrases":"{\"focus\":{\"keyphrase\":\"Insecure Direct Object Reference\",\"analysis\":{\"keyphraseInTitle\":{\"title\":\"Focus keyphrase in SEO title\",\"description\":\"Focus keyphrase found in SEO title.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseInDescription\":{\"title\":\"Focus keyphrase in meta description\",\"description\":\"Focus keyphrase found in meta description.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"title\":\"Focus keyphrase length\",\"description\":\"Good job!\",\"score\":9,\"maxScore\":9,\"error\":0,\"length\":4},\"keyphraseInURL\":{\"title\":\"Focus keyphrase in URL\",\"description\":\"Focus keyphrase used in the URL.\",\"score\":5,\"maxScore\":5,\"error\":0},\"keyphraseInIntroduction\":{\"title\":\"Focus keyphrase in introduction\",\"description\":\"Your Focus keyphrase does not appear in the first paragraph. Make sure the topic is clear immediately.\",\"score\":3,\"maxScore\":9,\"error\":1},\"keyphraseInSubHeadings\":{\"title\":\"Focus keyphrase in Subheadings\",\"description\":\"Your H2 and H3 subheadings reflects the topic of your copy. Good job!\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseInImageAlt\":{\"title\":\"Focus keyphrase in image alt attributes\",\"description\":\"Focus keyphrase found in image alt attribute(s).\",\"score\":9,\"maxScore\":9,\"error\":0}},\"score\":90},\"additional\":[{\"keyphrase\":\"IDOR\",\"score\":100,\"analysis\":{\"keyphraseInDescription\":{\"title\":\"Keyphrase in meta description\",\"description\":\"Keyphrase found in meta description.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"title\":\"Keyphrase length\",\"description\":\"Good job!\",\"score\":9,\"maxScore\":9,\"error\":0,\"length\":1},\"keyphraseInIntroduction\":{\"title\":\"Keyphrase in introduction\",\"description\":\"Your Keyphrase appears in the first paragraph. Well done!\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseInImageAlt\":{\"title\":\"Keyphrase in image alt attributes\",\"description\":\"Keyphrase found in image alt attribute(s).\",\"score\":9,\"maxScore\":9,\"error\":0}}},{\"keyphrase\":\"Vulnerability\",\"score\":83,\"analysis\":{\"keyphraseInDescription\":{\"title\":\"Keyphrase in meta description\",\"description\":\"Keyphrase found in meta description.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"title\":\"Keyphrase length\",\"description\":\"Good job!\",\"score\":9,\"maxScore\":9,\"error\":0,\"length\":1},\"keyphraseInIntroduction\":{\"title\":\"Keyphrase in introduction\",\"description\":\"Your Keyphrase does not appear in the first paragraph. Make sure the topic is clear immediately.\",\"score\":3,\"maxScore\":9,\"error\":1},\"keyphraseInImageAlt\":{\"title\":\"Keyphrase in image alt attributes\",\"description\":\"Keyphrase found in image alt attribute(s).\",\"score\":9,\"maxScore\":9,\"error\":0}}}]}","primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"featured","og_image_url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/08\/IDOR.png","og_image_width":"1060","og_image_height":"593","og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":"Web Application Security","og_article_tags":[],"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":"{\"article\":{\"articleType\":\"BlogPosting\"},\"course\":{\"name\":\"\",\"description\":\"\",\"provider\":\"\"},\"faq\":{\"pages\":[]},\"product\":{\"reviews\":[]},\"recipe\":{\"ingredients\":[],\"instructions\":[],\"keywords\":[]},\"software\":{\"reviews\":[],\"operatingSystems\":[]},\"webPage\":{\"webPageType\":\"WebPage\"}}","pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"open_ai":null,"created":"2021-10-27 15:11:07","updated":"2022-12-02 07:11:56"},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.varutra.com\/varutravrt3\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.varutra.com\/varutravrt3\/category\/web-application-security\/\" title=\"Web Application Security\">Web Application Security<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\tInsecure Direct Object Reference (IDOR)\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.varutra.com\/varutravrt3"},{"label":"Web Application Security","link":"https:\/\/www.varutra.com\/varutravrt3\/category\/web-application-security\/"},{"label":"Insecure Direct Object Reference (IDOR)","link":"https:\/\/www.varutra.com\/varutravrt3\/insecure-direct-object-reference-idor\/"}],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/15634"}],"collection":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/comments?post=15634"}],"version-history":[{"count":5,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/15634\/revisions"}],"predecessor-version":[{"id":20274,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/15634\/revisions\/20274"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/media\/15654"}],"wp:attachment":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/media?parent=15634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/categories?post=15634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/tags?post=15634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}