IDOR Testing Methodology

Overview

IDOR occurs when an application uses user-supplied input to access objects directly without proper authorization checks.

Types

1. Horizontal IDOR: Access other users' data at same privilege level
2. Vertical IDOR: Access higher privilege resources

Testing Methodology

1. Identify Object References

• Numeric IDs: /api/users/123
• UUIDs: /api/orders/550e8400-e29b-41d4-a716-446655440000
• Encoded IDs: Base64, Hashes
• File names: /documents/report_123.pdf