Insecure Direct Object References (IDOR) WAHS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   An attacker changes a request parameter from 'account_id=1001' to 'account_id=1002' and successfully views another user's account details. What type of attack has occurred?

   • ACross-site request forgery (CSRF)
   • BSQL injection
   • CInsecure Direct Object Reference (IDOR)
   • DCross-site scripting (XSS)
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A bug bounty hunter is reviewing an API that uses GUIDs for document IDs. The hunter notices that the API returns a '403 Forbidden' when accessing a document that belongs to another user, but the response time is slightly longer than when accessing one's own document. Which conclusion is most appropriate?

   • AThe application is vulnerable to IDOR because GUIDs are predictable
   • BThe hunter should stop testing because the API is not vulnerable
   • CThe application likely performs an authorization check, but the timing difference may indicate a side-channel that could reveal object existence
   • DThe API is completely secure because it returns 403 for unauthorized access
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is reviewing a web application's traffic logs and notices requests to /download?file=report_2023.pdf. The analyst suspects IDOR. Which observation would most strongly support this suspicion?

   • AThe file parameter accepts a predictable filename, and users can access files by changing the filename to other users' reports
   • BThe application uses HTTPS for all requests
   • CThe server returns a 404 error for non-existent files
   • DThe log shows requests from multiple IP addresses
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A large enterprise application has multiple microservices. One service handles user profiles and uses sequential IDs; another handles documents and uses UUIDs. Both services lack authorization checks. The security team must prioritize fixes with limited resources. Which approach is most appropriate?

   • AImplement rate limiting on both services and ignore authorization
   • BPrioritize fixing the profile service because sequential IDs are easier to enumerate, but also implement authorization checks in both services
   • CDefer fixes until a breach occurs to justify the budget
   • DOnly fix the document service because UUIDs are more secure
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A penetration tester is assessing a web application that uses a mix of REST and GraphQL APIs. The tester has identified a potential IDOR in a REST endpoint but wants to confirm it. Which step is most appropriate to validate the vulnerability?

   • ASend the request without authentication to see if it is blocked.
   • BCheck the HTTP response headers for security misconfigurations.
   • CRun a SQL injection scan on the endpoint.
   • DAuthenticate as two different users and attempt to access each other's objects using the same endpoint.
   Reveal Solution Discussion Select an answer first