How I Get $1350 From IDOR Just Less 1 hours

3 min readDec 23, 2021

Assalamualaikum, wr,wb ,

Hello folks, My name is Anonymous, Im an Security Enthusiast, I started the world of bug hunting since early 2021, and this is a writeup of my findings, for which I got my first sizable prize $$$$.

the finding is named Insecure Direct Object References, Insecure direct object references (IDOR) are a type of access control vulnerability that arises when an application uses user-supplied input to access objects directly. The term IDOR was popularized by its appearance in the OWASP 2007 Top Ten. However, it is just one example of many access control implementation mistakes that can lead to access controls being circumvented. IDOR vulnerabilities are most commonly associated with horizontal privilege escalation, but they can also arise in relation to vertical privilege escalation.

Insecure direct object references (IDOR) are a type of access control vulnerability that arises when an application uses user-supplied input to access objects directly. The term IDOR was popularized by its appearance in the OWASP 2007 Top Ten. However, it is just one example of many access control implementation mistakes that can lead to access controls being circumvented. IDOR vulnerabilities are most commonly associated with horizontal privilege escalation, but they can also arise in relation to vertical privilege escalation.

Step To Reproduce :

Im try to register with 2 defferent account on redacted.com, call it account A = Attacker and Account B = Victim.

First time side attacker or Account A :

Attacker visit to https://redacted.com/websites/10-21xxxxx/alerts/configuration
Before Delete Data from Victim, Attacker must turn on proxy which is Burp Suite Community Edition.
After turn on proxy a.k.a burp suite, Attacker can click Delete Data like screenshoot below :

4. Then Attacker can move to burp suite to see request when click Delete Data and as you can see screenshot like below :

5. On json data “alertDefinitionIds” id attacker is 4478250 [“attacker can change id to victim account”] , in this case victim id is https://redacted.com/websites/13-2292xxx/alerts/configuration/edit/4478118?group=page_alerts&type=page_type_change

6. Boom , Got 200 OK

How To Increase Impact Of This Vulnerbillity, and how attacker can mass delete data from user?

Attackers can use the help of the intruder plugin on the burp suite community edition.
On Original request delete data above, and then send request to intruder and mark alertDefinitionIds”:[“§4478118§”] with add , like screenshot below :