Insecure Direct Object References (IDOR) WAHS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is designing a new API for a customer portal. The API will expose order history, invoices, and support tickets. The team wants to prevent IDOR while maintaining good usability (e.g., bookmarkable URLs). Which design decision best balances security and usability?

   • AUse sequential IDs and rely on security through obscurity by not documenting the API
   • BUse a single shared ID for all users to simplify the design
   • CUse opaque, unguessable identifiers (e.g., UUIDs) for all resources and enforce server-side authorization checks
   • DUse sequential IDs but hide them behind a login page
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A developer wants to automate the detection of IDOR vulnerabilities in a web application that uses numeric IDs. Which automated testing technique is most suitable?

   • APerforming a dictionary attack on the login form
   • BRunning a TLS vulnerability scanner against the web server
   • CUsing a crawler to map all links on the site
   • DFuzzing the ID parameter with a list of sequential and boundary values while authenticated as a low-privileged user
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An IDOR vulnerability in a project management tool allows a regular user to change the 'project_id' in a request and gain access to another company's project files. The tool is used by multiple organizations. What is the most critical business impact?

   • ALoss of administrator privileges for the regular user.
   • BTemporary unavailability of the project management tool.
   • CIncreased server load due to excessive requests.
   • DCross-tenant data leakage, violating confidentiality agreements and potentially causing legal consequences.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a business logic abuse that could result from an IDOR vulnerability?

   • AAn attacker modifies the 'order_id' parameter to cancel another customer's order.
   • BAn attacker sends a phishing email to obtain credentials.
   • CAn attacker uses a SQL injection to extract the entire database.
   • DAn attacker performs a brute-force attack on the login form.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a systematic approach to test for IDOR vulnerabilities in a web application?

   • ALog in as two different users and compare responses when accessing each other's objects by modifying object IDs.
   • BPerform a ping sweep to identify active hosts.
   • CReview the application's source code for hardcoded credentials.
   • DRun a vulnerability scanner that only checks for SQL injection.
   Reveal Solution Discussion Select an answer first