Insecure Direct Object References (IDOR) WAHS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A user of an online document management system reports that after changing the numeric value in the URL from /download?doc=4821 to /download?doc=4822, they can view another user's confidential contract. The application authenticates the user but does not verify that the document belongs to them. Which type of vulnerability is being exploited?

   • ACross-Site Request Forgery (CSRF)
   • BInsecure Direct Object Reference (IDOR)
   • CSQL Injection
   • DBroken Authentication
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which technique is used to prevent IDOR by replacing direct object references with random, unguessable tokens?

   • AOutput encoding
   • BInput validation
   • CIndirect reference map
   • DRate limiting
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   After a major IDOR breach, a company conducts a post-mortem. The root cause was that the development team assumed the client-side UI would only send valid IDs. Which systemic change would best prevent similar issues in the future?

   • ARequire all developers to attend a one-time security training session
   • BImplement a bug bounty program to find future vulnerabilities
   • CUse a different programming language for new development
   • DAdopt a security development lifecycle that includes threat modeling, secure code reviews, and automated security testing in CI/CD
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is examining a web application that uses sequential numeric IDs in API endpoints like /api/v1/invoices/1001. The tester wants to systematically identify IDOR vulnerabilities. Which approach is most effective?

   • AReview the server logs for failed login attempts.
   • BRun a network vulnerability scanner against the server to find open ports and services.
   • CIntercept requests with a proxy and manually change the invoice ID to another value while authenticated as a low-privilege user.
   • DPerform a DNS enumeration to discover subdomains.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is migrating a legacy application to a new framework. The legacy app uses sequential IDs and has several known IDOR vulnerabilities. The team wants to fix them during migration. They have two options: (A) implement indirect reference maps and (B) add authorization checks. Which option should be prioritized?

   • AUse only indirect reference maps to avoid changing the database schema.
   • BImplement authorization checks first, then use indirect references as a defense-in-depth measure.
   • CUse a WAF to block suspicious requests.
   • DAdd input validation to ensure IDs are within a certain range.
   Reveal Solution Discussion Select an answer first