Bug › Module 6 › Lesson 2
IDOR Named
Insecure direct object reference literacy — authorization gaps hunters spot on $PROGRAM scope, not ID-guessing on stranger APIs.
Visual · t20_idor_named
IDOR = access object by changing identifier without proper authZ. $PROGRAM only. Original Cyberlium.
Opening
IDOR is an authorization failure — learn to see ID swaps and role gaps, not to harvest every user's data on sites you never joined.
Insecure Direct Object Reference (IDOR) and broader broken access control mean the server fails to verify whether the requester may access the object identified by an ID, UUID, filename, or account token. Hunters think: swap identifiers between two test accounts you own, compare role responses, check horizontal vs vertical escalation — always with minimal proof. Cyberlium names IDOR, BOLA (API variant), CWE-639, and defender patterns (server-side authZ on every object, unpredictable IDs as defense-in-depth only) on YOUR $PROGRAM in-scope assets or $LAB_BOUNTY — not sequential ID scraping on stranger production, not downloading other users' invoices or medical records, not automated mass enumeration out of scope. Validation = one redacted screenshot or response diff between your two lab accounts — never exfil real PII.
1. How hunters think
Create two roles or accounts in scope (yours). Request object A as user 1, object B as user 2 — swap IDs in URL, body, GraphQL variables, mobile API headers.
Ask: does the server check ownership on every path, including export, preview, and mobile-only endpoints from your asset map?
Command guide
Try these commands — How hunters think
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
IDOR literacy — object ID across users/roles Request shaping — curl query params on httpbin or scope
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS 'https://httpbin.org/get?id=1&user=lab' | jq '.args' curl -sS 'https://httpbin.org/get?id=2&user=lab' | jq '.args'
Primary tools to practice this lesson: curl, jq. Reference sites: IDOR literacy; Request shaping. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender controls
Server-side authorization on every object access — never trust client-side hiding of buttons.
Centralized authZ service, audit logs on sensitive object reads, rate limits on ID-oriented endpoints, break-glass monitoring.
3. Scope and harm boundary
IDOR tests only on $PROGRAM assets with two accounts you control — stop at first foreign object proof, do not bulk-download.
No IDOR on out-of-scope subdomains, no guessing IDs on unenrolled programs, no retaining other users' data in notes.
4. What you ship: IDOR literacy card
IDOR/BOLA definition + two-account test method + two defender controls + minimal proof rule.
5. What you record before the next lesson
IDOR literacy card path.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Scrape sequential invoice IDs on unenrolled e-commerce and save PDFs 'for the report.'
Right
Name IDOR and two-account method on scope. Next: SSRF and Logic Flaws.
Mission: IDOR literacy card
1) Define IDOR in one sentence. 2) Describe two-account swap test. 3) Name two defender controls. 4) Write minimal proof — no bulk exfil.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “GraphQL IDOR — same authZ rule?”
Knowledge Check
APPLY: IDOR means:
Multiple choice
Knowledge Check
APPLY: True or False: Bulk downloading user records proves IDOR responsibly.
True or False
Knowledge Check
APPLY: Defenders fix IDOR with:
Multiple choice