---
description: >-
  To quote the folks over at Portswigger, IDORs are a type of access control
  vulnerability that arises when an application uses user-supplied input to
  access objects directly
---

# Insecure Direct Object Reference

## Basic example

Let's imagine the website we're using allows us to browse our own user profile. We notice that the url looks something like `http://website/customer_profile?id=10`

That very probably implies that profiles 1 to 9 do also exist. If we attempt to access `http://website/customer_profile?id=1` and are allowed to do so by the application, then there is an IDOR vulnerability

Please note that some of those parameters may not always be in clear text, but may be encoded or even hashed (i.e base64 or md5).
