Lion Cipher Lab
Test for broken access control (IDOR) — on your own app
- Penetration Testing / Red Team
- Beginner
- ~40 min
- Free · no account required
Why it matters
Broken Access Control is the number-one risk in the OWASP Top 10, and its most common form is the Insecure Direct Object Reference (IDOR): an application uses a value from the request — an id in a URL or body — to fetch a record, but fails to check that the logged-in user is actually allowed to see THAT record. Change the id, get someone else's data. It's devastatingly common and easy to introduce, because it works fine in testing (you only ever look at your own data) and only fails when someone tries another id. Learning to test for it — safely, on your own app — and understanding the one…
What you'll learn
- what broken access control / IDOR is
- spotting object references in requests
- testing access control by changing an id (on your own app)
- why client-side checks are not access control
- the server-side authorization fix
Steps in this lab
- The rule, and what broken access control is
- Spot the object references in requests
- Test it: change an id you own to one you don't
- Understand why it happens: missing server-side checks
- The fix: authorize every object access on the server
- Test the whole surface, not one endpoint
- Why the #1 risk is worth mastering