Testing for Insecure Direct Object References

Insecure Direct Object References (IDOR) occur when an application references objects in an insecure way that allows user-supplied input to manipulate and directly access those objects. Attackers that exploit this vulnerability are able to bypass authorization and directly access resources on the server (i.e, database records or files).

Getting ready

To start, ensure that ZAP is started and use the PortSwigger Academy lab, Insecure direct object references.

How to do it…

Here, we’ll attack a live chat feature of the application, which will allow us to view other users’ messages to the fictitious web app support. Let’s look at the steps:

1. Start by navigating in the PortSwigger Academy lab to the Live Chat feature.
2. While capturing the traffic, click the View Transcript button.

You will notice that this downloads a numbered text file. When you look at the response in ZAP’s Manual...