# Insecure Direct Object References (IDOR)

**Level:** <mark style="color:green;">**Apprentice**</mark>

<figure><img src="/files/4pYmG94yZv5uexHAwt9r" alt=""><figcaption></figcaption></figure>

### What's an IDOR?

* Insecure direct object references (**IDOR**) **are a subcategory of access control vulnerabilities.**
* **IDOR** arises when an application uses user-supplied input to access objects directly and an attacker can modify the input to obtain unauthorized access.

<figure><img src="/files/IkTKWlXqtqbQmhVln2Dm" alt=""><figcaption></figcaption></figure>

* Here we have a live chat, and we can click on the function transcript to download our conversation
* Intercepting the request, you'll see a **302-status code***, just follow the redirection.*

<figure><img src="/files/kEVlHdR9tZYyR4LcVgK0" alt=""><figcaption></figcaption></figure>

* We see that we are downloading a file called `6.txt.`
* Let's try to access other conversations by changing our `6.txt` to `1.txt.`

<figure><img src="/files/pekirbPboaKDx7ggmtOi" alt=""><figcaption></figcaption></figure>

* When we change the number, we can *'accidentally'* get another transcript.
* In the `1.txt` is filtering the Carlos conversation to recover the password, so copied and log in.

<figure><img src="/files/MHzuqaQqSpwQTSynY9BW" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://hackzzz.gitbook.io/welcome/welcome/writeups/portswigger/access-control/apprentice/insecure-direct-object-references-idor.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.