Insecure Direct Object References (IDOR) WAHS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In a well-known IDOR case, a social media platform allowed users to change the 'user_id' parameter in a URL to view other users' private messages. What is the key lesson from this case?

   • AUsers should be required to change their passwords frequently.
   • BHTTPS is sufficient to protect user data.
   • CThe platform should have used CAPTCHA to prevent automated attacks.
   • DObject identifiers should be unpredictable and access control must be enforced on every request.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security researcher is testing a mobile app that syncs with a backend API. The app uses the endpoint /v1/messages?conversationId=9876. The researcher changes the conversationId to 9875 and receives the messages from another user's conversation. Which action should the researcher take to responsibly disclose this finding?

   • ADownload all messages from other conversations to demonstrate the impact
   • BDocument the vulnerability with proof-of-concept and report it through the vendor's responsible disclosure program
   • CPost the vulnerability on a public forum to pressure the vendor
   • DIgnore the finding because the researcher was not authorized to test
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A cloud-based application stores user documents in a private blob storage. The application generates pre-signed URLs for downloads. A security auditor finds that the pre-signed URLs are valid for 24 hours and can be used to access any document if the document ID is known. Which mitigation is most appropriate?

   • AEncrypt the document ID in the pre-signed URL
   • BShorten the pre-signed URL validity and include a per-user authorization check before generating the URL
   • CStore documents in a public bucket and rely on obscurity
   • DUse a longer pre-signed URL validity to reduce the number of requests
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is migrating a legacy application to a new framework. The legacy app uses sequential IDs in URLs and has no authorization checks. The team wants to implement a mitigation that is both effective and minimally invasive. Which approach is the best first step?

   • ADisable direct URL access and require users to navigate through the UI only
   • BChange all URLs to use random UUIDs immediately
   • CAdd a centralized authorization middleware that checks object ownership for all requests
   • DImplement rate limiting on all endpoints
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A penetration tester is testing an API that uses base64-encoded IDs in the URL, such as /api/order/MTIzNDU=. The tester decodes the ID and finds it is a sequential number. Which testing step should the tester perform next to confirm IDOR?

   • AEncode a different sequential number and request the corresponding order while authenticated as a different user
   • BRun a port scan on the server
   • CCheck if the server supports HTTP/2
   • DTest for SQL injection by adding a single quote to the ID
   Reveal Solution Discussion Select an answer first