IDOR (Insecure Direct Object Reference) is one of the most common and high-impact vulnerabilities found in web applications today. It allows attackers to access or manipulate objects (like user data, files, or transactions) by modifying the value of a parameter used in a request.
In this detailed guide, we will explore how to find an IDOR vulnerabilities in real-world websites, how to report them, and what tools, mindset, and techniques actually work in 2025. If you’re a beginner or intermediate bug bounty hunter in India, this guide is made for you.
What Is an IDOR Vulnerability?
IDOR stands for Insecure Direct Object Reference. It happens when an application exposes internal object identifiers, like user IDs or file names, and doesn’t properly check if the user is authorized to access them.
Example:
GET /api/v1/user/12345/profileChanging 12345 to 12346 might show someone else’s data if proper authorization is missing.
Real-World Examples of IDOR
- Accessing other users’ profiles or order history.
- Downloading files that belong to other users.
- Resetting passwords of other accounts via unprotected endpoints.
- Viewing or editing tickets, tasks, or messages of others.
Step-by-Step Process to Find IDOR
1. Choose the Right Target
Pick programs or websites with user-based features:
- E-commerce
- SaaS platforms
- Social media platforms
- Banking or fintech apps
Check platforms like HackerOne, Bugcrowd, or Intigriti for suitable targets with IDOR scope.
2. Recon and Login
- Register two test accounts (User A and User B)
- Use different devices, incognito mode, or browser profiles
- Perform actions like viewing/editing/deleting profiles, uploading files, checking orders
3. Intercept Requests Using Burp Suite
- Turn on Burp Intercept
- Perform an action using User A
- Note the request and response
- Now log in as User B and repeat the same action
- Compare the requests
4. Look for Identifiers
Focus on the following in the request:
user_idaccount_idorder_numberfile_idprofile_id
5. Modify the ID and Replay
- Change the ID in the request to the ID of the other user/account/file.
- Forward the request and observe the response.
If you’re able to access or change the data without error, it’s likely an IDOR.
6. Verify the Impact
- Can you read sensitive data?
- Can you change/delete someone else’s content?
- Can you perform unauthorized actions like transfer money or reset passwords?
Record everything using screenshots, curl commands, and steps.
Tools That Help Find IDOR
Manual Tools
- Burp Suite (Community or Pro)
- Postman (for API testing)
- FoxyProxy + browser testing
Automated Tools
- Autorize (Burp plugin for IDOR detection)
- AuthMatrix (for auth flow testing)
- Param Miner (for hidden parameters)
Scripts and Extensions
- Interlace for automating requests
- Custom Python scripts to fuzz IDs or tokens
Pro Tips from Indian Bug Bounty Hunters
- Always have 2 accounts: It’s the easiest way to test authorization checks.
- Use VPN or proxy tools to simulate multiple users/devices.
- Don’t rely on status code alone. Sometimes you’ll get 200 OK but no data.
- Watch for tokens: Even with
JWT, some systems leak object IDs. - Test both GET and POST requests — IDOR can exist in any method.
- Check mobile apps too: Use tools like MobSF or Frida for testing Android apps.
Real Payload Example
Step 1: Normal Request by User A
GET /orders/12793
Host: example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...
Step 2: Change ID to Another User’s Order
GET /orders/12794
If you get the order details of another user — it’s an IDOR.
How to Report IDOR
When you find a valid IDOR, report it properly:
Report Format
- Title: IDOR in /orders endpoint allows access to other users’ orders
- Summary: Changing the
order_idparameter allows access to unauthorized data. - Steps to Reproduce: List each step clearly
- Impact: Data leak, privacy violation, etc.
- PoC: Curl or screenshot
Mistakes to Avoid
- Don’t brute-force user IDs (may lead to account lock or rate-limiting).
- Don’t test outside scope in public programs.
- Avoid automated testing without understanding requests.
- Don’t confuse IDOR with broken authentication.
Common Targets for IDOR
- Profile update pages
- Invoice or payment views
- File download links
- REST APIs (especially
/api/v1/...) - Mobile app endpoints
Final Checklist
✅ Two accounts created (A & B)
✅ Requests intercepted and tested
✅ Identifiers found and modified
✅ Results verified and documented
✅ Report written with proper structure
Conclusion
Finding IDOR vulnerabilities doesn’t need heavy tools or coding skills. With the right logic, a curious mind, and consistent testing, even beginner bug bounty hunters in India can find impactful IDOR bugs.
Start small, focus on logic, and build your skill every day. Don’t give up after a few failures — keep learning, practicing, and growing.
Happy Hunting, bhaiyo aur behno! 🧠💻🔍
