TryHackMe - IDOR

Task 1 - What is an IDOR?

What does IDOR stand for?

Insecure Direct Object Reference

Task 2 - An IDOR Example

What is the Flag from the IDOR example website?

clicking on our order invoice and changing invoice url id to 1000 we get our flag THM{IDOR-VULN-FOUND}

Task 3 - Finding IDORs in Encoded IDs

What is a common type of encoding used by websites?

base64

Task 4 - Finding IDORs in Hashed IDs

What is a common algorithm used for hashing IDs?

md5

Task 5 - Finding IDORs in Unpredictable IDs

What is the minimum number of accounts you need to create to check for IDORs between accounts?

2

Task 6 - Where are IDORs located

No answer needed

Task 7 - A Practical IDOR Example

for this task we can spin up our machine and create a new test account, visiting customers -> your account and observing our network tab we see a request with id parameter changing id to any other integer gives us info of other users