What a Single File Name Taught Me About IDOR (PortSwigger Lab)
My transcript downloaded as 2.txt . That was the entire vulnerability, sitting right there in a file name, and it took less time to exploit than it did to notice. This is a PortSwigger Web Security Academy lab, part of the access control section I've been working through. The setup is a support chat feature that stores each user's transcript directly on the server's file system and serves it back…
A single file name revealed an Insecure Direct Object Reference (IDOR) vulnerability in a PortSwigger Web Security Academy lab. The lab's setup involved a support chat feature that stored user transcripts directly on the server's file system and served them through static URLs. The goal was to find the password for a user named "carlos" hidden in his transcript and impersonate him.
The vulnerability was discovered when the lab file was named "2.txt". The lab demonstrated how a direct reference to a specific object (the file name) was exposed to the client, and the server trusted it without validation. To exploit the vulnerability, the lab requested "1.txt" instead of "2.txt", successfully accessing the password of user "carlos".
The key difference between IDOR and other types of access control failures lies in the server's reliance on the user-controlled value (file name) without verifying ownership. The lab emphasized two possible solutions to prevent such vulnerabilities: 1) stop letting the client name the resource and map the authenticated session to its own file server-side, or 2) use an unguessable identifier, such as a UUID, and still verify ownership server-side.
The main takeaway was that the same principle of checking ownership server-side applies to IDOR, making it a more specific case of broken access control.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
