Insecure Direct Object References (IDOR) WAHS Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A penetration tester is assessing a web application that uses sequential numeric IDs for user profiles. The tester wants to systematically identify IDOR vulnerabilities across multiple endpoints. Which testing approach is most effective for this purpose?

   • AIntercept requests with a proxy, then iterate through sequential IDs in the profile endpoint while logged in as a low-privileged user and compare responses
   • BAttempt to access the admin panel by guessing common directory names
   • CRun a vulnerability scanner that only checks for SQL injection in the login form
   • DReview the client-side JavaScript code to find hidden API endpoints
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A well-known social media platform experienced a data breach where attackers accessed private photos of celebrities by changing the numeric photo ID in the URL. The platform had authentication but lacked authorization checks. What is the key lesson from this real-world case?

   • AAuthentication alone is insufficient; every object access must be authorized.
   • BThe platform should have used longer numeric IDs.
   • CThe attack was possible because the photos were stored on a public CDN.
   • DUsing HTTPS would have prevented the attack.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An attacker discovers that by changing the 'order_id' in a POST request to /api/orders/cancel, they can cancel other users' orders. The application does not verify that the order belongs to the authenticated user. What is the most likely impact of this IDOR exploitation?

   • APrivilege escalation to administrator role
   • BBusiness logic abuse by performing unauthorized actions on other users' orders
   • CDenial of service to the entire application
   • DCross-site scripting (XSS) attack on other users
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A penetration tester is testing a web application that uses both numeric and GUID-based object references. The tester has limited time and must prioritize testing for IDOR. Which approach is most efficient?

   • AFocus on endpoints that use sequential numeric IDs, as they are more likely to be guessable and vulnerable.
   • BSpend equal time testing all endpoints regardless of ID type.
   • CRun a vulnerability scanner that automatically detects IDOR.
   • DOnly test endpoints that use GUIDs because they are more complex.
   Reveal Solution Discussion Select an answer first