Broken Access Control encompasses any case where an application fails to enforce authorization checks, allowing users to access resources or perform actions beyond their intended permissions. IDOR (Insecure Direct Object Reference) is the most common subtype: the application uses user-controllable input (like an ID number) to directly reference a database record or file without checking whether the requesting user is authorized to access that specific object.
Detection Methodology
Access another user's data at the same privilege level. Vertical privilege escalation: Access functionality reserved for higher privilege roles.
- Numeric IDs in URLs: /user/1337, /order/42, /invoice/9
- UUIDs: /file/a8f3b2c1-...
- Usernames: /profile/john
- Filenames: /download?file=report_john.pdf
Change ID to another user's: /user/1337 → /user/1
Change UUID: /file/your-uuid → /file/someone-elses-uuid
Log in as User A and User B simultaneously in different browsers
Capture User A's IDs → replay as User B
Burp Suite Testing Workflow
Intruder · enumerate IDs
1. Capture request: GET /api/user/1337
2. Send to Intruder → mark §1337§ as payload position
3. Payload type: Numbers → Sequential 1 to 1000
4. Filter responses by length or status code
5. 200 OK with different content = IDOR confirmed
Repeater · manual testing
1. Capture any request referencing an ID
2. Send to Repeater
3. Change ID to different values: 0, 1, 2, -1, 9999
4. Change role parameter: role=user → role=admin
5. Change ownership param: user_id=5 → user_id=1 (admin)
Real Examples
API endpoint manipulation
GET /api/user/1337 → try /api/user/1 (admin)
GET /api/user/1337 → try /api/user/0
GET /api/orders/9812 → try /api/orders/1
DELETE /api/post/456 → can you delete another user's post?
File download parameters
GET /download?file=user_1337_invoice.pdf
→ Try: /download?file=user_1_invoice.pdf
→ Try: /download?file=../../../etc/passwd (LFI via IDOR)
UUID manipulation (UUIDs are guessable if sequential or weak)
GET /profile/a8f3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c
→ Try patterns from known UUIDs
Role parameter in POST body
POST /api/update-profile
{"user_id": 5, "role": "user", "email": "test@test.com"}→ Try: {"user_id": 5, "role": "admin", "email": "test@test.com"}Admin functions in request body
POST /api/admin/delete-user
{"target_id": 1}→ Try sending as a normal user (missing auth check on server)
Common IDOR Locations
| Location | What to Modify |
|---|---|
| REST API endpoints | Numeric ID in URL path |
| File download parameters | Filename or ID in query string |
| Profile/account pages | user_id or account in request |
| Order/invoice history | Order ID in URL or body |
| Admin functions | Remove/change role parameter |
| Password reset tokens | Sequential or guessable tokens |
| Export/report generation | Reference IDs in request body |