# IDOR

Task 1: What is an IDOR?

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FGNWFch5bITWm5zuIAoYE%2Fimage.png?alt=media&#x26;token=1d770bda-7af5-427c-ab99-e97da52fb51f" alt=""><figcaption></figcaption></figure>

Task 2: An IDOR Example

Just click order confirmation

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fnjq180gsJ7all1g4nPtD%2Fimage.png?alt=media&#x26;token=f2586463-7ccc-4486-9a47-f5a454e140c8" alt=""><figcaption></figcaption></figure>

Then change the number of the invoice to 1000&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FrfUM7VElmY88Mc31hwaD%2Fimage.png?alt=media&#x26;token=c1c45d31-884b-4e08-9cd1-61094d53a03d" alt=""><figcaption></figcaption></figure>

Task 3: Finding IDORs in Encoded IDs

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FkHOVxqGNPmdAKDX0Zk9B%2Fimage.png?alt=media&#x26;token=5e8eb4fc-7a7e-49a8-8966-5b9313995d51" alt=""><figcaption></figcaption></figure>

Task 4: Finding IDORs in Hashed IDs

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FNAyR9cryvAKrHnuCJCsi%2Fimage.png?alt=media&#x26;token=a2d4209f-eecd-4283-8de1-140990e48778" alt=""><figcaption></figcaption></figure>

Task 5: Finding IDORs in Unpredictable IDs

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FFZEevjzBK6OVYhr5EsNx%2Fimage.png?alt=media&#x26;token=f27709b6-c82f-46b0-9273-f711958e8ce7" alt=""><figcaption></figcaption></figure>

Task 6: Where are IDORs located

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FkEJ6M0nLcynTgsMA8RLQ%2Fimage.png?alt=media&#x26;token=b4c34edc-7cf8-489d-a0eb-3d7d9b2c5c73" alt=""><figcaption></figcaption></figure>

Task 7: A Practical IDOR Example

For this practical exam, we have to create a account first in the sign up section of the website

Then navigate to "Your Account" section of the page to see your details

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fp0KJSPHy7BtEdcDhRf6Y%2Fimage.png?alt=media&#x26;token=9f8a183b-4108-4df1-9887-b763bd9839da" alt=""><figcaption></figcaption></figure>

After that you will go to network in the Developers tool and REFRESH the page so that it will display the api call of the website

As you can see here your ID number is 15 customer?id=15

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FcFW1Wq5Jf45OPKxWVr70%2Fimage.png?alt=media&#x26;token=1a1001f3-6a93-4bf6-9eb1-574f17207a13" alt=""><figcaption></figcaption></figure>

Try changing the id to 1 and you will see other user's information

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FE5KqxfI5Yf9bos0Av1pP%2Fimage.png?alt=media&#x26;token=7bc35c45-ee3f-4a4a-a607-72f1060ac318" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FxaDE6AXYW1bW5xd4GsKj%2Fimage.png?alt=media&#x26;token=8cb74114-a16d-4f2b-9524-f843b2201ca7" alt=""><figcaption></figcaption></figure>
