IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.

SKILL: IDOR / Broken Object Level Authorization — Expert Attack Playbook AI LOAD INSTRUCTION : IDOR is the 1 bug bounty finding. This skill covers non obvious IDOR surfaces, all attack vectors (not just URL params), A B testing methodology, BOLA vs BFLA distinction, chaining IDOR to higher impact, and what testers repeatedly miss. 1. IDOR vs BOLA vs BFLA Term Meaning Impact IDOR Insecure Direct Object Reference Read/modify other users' data BOLA Broken Object Level Authorization (OWASP API Top 10 A1) Same as IDOR, API terminology BFLA Broken Function Level Authorization Low priv user accesses HIGH PRIV functions (e.g., admin endpoints) Key distinction : BOLA = accessing object you shouldn't own (data belonging to other users) BFLA = accessing function you shouldn't be authorized for (admin CRUD operations, bulk actions, user management) 2. WHERE TO FIND OBJECT IDs (ALL LOCATIONS) Don't stop at URL path parameters — IDs appear in: 3. A B TESTING METHODOLOGY The most systematic IDOR test approach: 4. ID TYPE ITS IMPLICATIONS ID Pattern Example Notes Sequential int id=1001 → id=1002 Easy prediction, high hit rate UUID v4 550e8400 ... Need to find UUID from other endpoints UUID v1 Clock based UUID Time predictable! Extract timestamp/MAC GUIDs from own data See in responses Collect all UUIDs from your own account data first Hashed IDs md5(user id) Try hashing sequential ints Encoded IDs base64( {"id":1001} ) Decode → modify → re encode Compound IDs /api/users/1/orders/5 Both IDs may be independently verifiable 5. HORIZONTAL vs VERTICAL PRIVILEGE ESCALATION Horizontal : UserA accesses UserB's data (same privilege level) Vertical : Low priv user accesses admin only functions Combined : Low priv IDOR that grants privilege escalation 6. HTTP METHOD ESCALATION When GET /resource/1234 is properly restricted, test ALL other verbs: Why this works : Authorization logic is often implemented per method, and developers forget edge cases. 7. PARAMETER POLLUTION & TYPE CONFUSION When id=1234 is validated, try: JSON Type Confusion : Some ORMs handle string vs integer differently in queries. 8. BFLA (FUNCTION LEVEL) ATTACKS Common BFLA Endpoints to Test How to Find Hidden Admin Endpoints 1. Read JS bundles — admin routes often exposed in frontend code 2. Look at API docs (Swagger/OpenAPI) for "admin", "internal", "privileged" tags 3. Enumerate /api/v1/admin/ , /api/v1/manage/ , /api/v1/internal/ 4. Burp "Discover Content" on API base path 5. Compare regular user docs vs admin section docs if available 9. INDIRECT IDOR (REFERENCE CHAIN) App checks permission on object A but doesn't check ownership of referenced object B : Example : Test: access attachments/sub resources directly via their IDs without going through parent endpoint. GraphQL variant : Inline querying related objects without separate authorization: 10. MASS ASSIGNMENT → PRIVILEGE ESCALATION When POST/PUT takes a JSON body, properties in the underlying model may be settable even if not in the official API docs: How to find hidden fields : 1. Intercept admin "create user" vs normal "register" — diff the fields 2. Read API documentation for all possible fields 3. Check source code if available (GitHub, JS bundles) 4. Fuzz with Burp: add common property names and check for 200 vs 400 11. STATE MACHINE ABUSE (BUSINESS LOGIC IDOR) When resources have a status/state: Test: Can you skip states? Can you set another user's order status? 12. QUICK IDOR CHECKLIST 13. SYSTEMATIC IDOR TESTING — 8 CATEGORIES Category Test Method 1 Direct ID reference Change numeric/UUID ID in URL: /api/users/123 → /api/users/124 2 Predictable UUID If UUIDs are v1 (time based), adjacent IDs are calculable 3 Batch/bulk operations /api/users/bulk?ids=123,456 — add other users' IDs 4 Export/download Export endpoint leaks other users' data: /export?user id= 5 Linked object IDOR Change order.address id to another user's address 6 Resource replacement Update own profile with another user's resource ID → overwrites 7 Write IDOR PUT/PATCH/DELETE with other user's ID — modify/delete their data 8 Nested object /api/orgs/1/users/2 — change org ID to access other org's users Testing Flow 14. ORM FILTER CHAIN LEAKS Django ORM Filter Injection Prisma Filter Injection Ransack (Ruby on Rails)

idor-broken-object-authorization