> For the complete documentation index, see [llms.txt](https://hackzzz.gitbook.io/welcome/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackzzz.gitbook.io/welcome/welcome/writeups/portswigger/access-control/apprentice/insecure-direct-object-references-idor.md).

# Insecure Direct Object References (IDOR)

**Level:** <mark style="color:green;">**Apprentice**</mark>

<figure><img src="/files/4pYmG94yZv5uexHAwt9r" alt=""><figcaption></figcaption></figure>

### What's an IDOR?

* Insecure direct object references (**IDOR**) **are a subcategory of access control vulnerabilities.**
* **IDOR** arises when an application uses user-supplied input to access objects directly and an attacker can modify the input to obtain unauthorized access.

<figure><img src="/files/IkTKWlXqtqbQmhVln2Dm" alt=""><figcaption></figcaption></figure>

* Here we have a live chat, and we can click on the function transcript to download our conversation
* Intercepting the request, you'll see a **302-status code***, just follow the redirection.*

<figure><img src="/files/kEVlHdR9tZYyR4LcVgK0" alt=""><figcaption></figcaption></figure>

* We see that we are downloading a file called `6.txt.`
* Let's try to access other conversations by changing our `6.txt` to `1.txt.`

<figure><img src="/files/pekirbPboaKDx7ggmtOi" alt=""><figcaption></figcaption></figure>

* When we change the number, we can *'accidentally'* get another transcript.
* In the `1.txt` is filtering the Carlos conversation to recover the password, so copied and log in.

<figure><img src="/files/MHzuqaQqSpwQTSynY9BW" alt=""><figcaption></figcaption></figure>