idor-broken-object-authorization

An expert attack playbook for finding IDOR and broken object-level authorization issues during security testing. It clarifies terminology up front: IDOR and BOLA (OWASP API Top 10) both concern accessing objects you should not own, while BFLA (Broken Function Level Authorization) concerns accessing functions or admin endpoints you should not be authorized for. Use it when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.

A recurring theme is that identifiers appear in far more than URL path parameters: query strings, request bodies, JSON fields, headers like X-User-ID and X-Account-ID, cookies, GraphQL arguments, hidden form fields, and WebSocket messages are all candidates for tampering. The core methodology is systematic A-B testing: create UserA and UserB, perform and capture all of UserA actions and object IDs, then replay those requests with UserB session to confirm cross-user read or write. It also catalogs ID patterns and their implications, from sequential integers to UUID v1 versus v4, hashed, encoded, and compound IDs, and distinguishes horizontal from vertical privilege escalation.

Additional vectors include HTTP method escalation (trying POST, PUT, PATCH, or DELETE when GET is blocked), parameter pollution and type confusion, BFLA against admin and bulk endpoints, indirect reference-chain IDOR on sub-resources such as attachments, mass assignment of hidden fields like role, isAdmin, and verified for privilege escalation, and state-machine or business-logic abuse. A closing checklist consolidates the tests (two accounts, mapping ID-bearing calls, all verbs, all ID locations, sub-resources, admin endpoints, and extra body fields) so a tester can work the surface methodically.