IDOR as ID Swap

Change the ID in path/query/body — server must still refuse. Lab :8815.

IDOR as ID Swap• Audio Walkthrough

00:00/02:23

Visual · api_idor_swap

IDOR is the classic ID swap. Original Cyberlium.

One digit change is enough when checks are missing.

Insecure Direct Object Reference is the older name for guessing or swapping IDs. On YOUR lab, compare /users/1/inbox vs /users/2/inbox with the same token.

1. Where IDs hide

Path (/users/2), query (?id=2), JSON body, headers. All need checks.

UUIDs reduce guessing but do not replace authorization.

Command guide

Try these commands — Where IDs hide

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

IDOR patterns — https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References API1 BOLA — https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl
sudo apt install jq

macOS:

Command — copy this

brew install jq

Windows: Built-in (PowerShell: Invoke-WebRequest)

Command — copy this

choco install jq

═══ LINUX / macOS ═══

Command — copy this

curl -sS -H "Authorization: Bearer userA" "http://127.0.0.1:8815/users/1/profile" | jq '.id // .userId // .'
curl -sS -o /dev/null -w "userA reads userB inbox %{http_code}
" -H "Authorization: Bearer userA" "http://127.0.0.1:8815/users/2/inbox"

Primary tools to practice this lesson: curl, jq. Reference sites: IDOR patterns (https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References); API1 BOLA (https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.