Insecure Direct Object References (IDOR) WAHS Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A large application has many endpoints that use direct object references. The security team wants to mitigate IDOR across the entire application with minimal code changes. They are considering (1) implementing a centralized authorization middleware, (2) replacing all IDs with UUIDs, or (3) adding input validation to reject non-numeric IDs. Which approach is the most effective and sustainable?

   • AReplace all numeric IDs with UUIDs across the database and application.
   • BAdd input validation to reject non-numeric IDs.
   • CUse a web application firewall (WAF) to block requests with modified IDs.
   • DImplement a centralized authorization middleware that enforces ownership checks on all object access.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which action is an example of exploiting an IDOR to perform an unauthorized action?

   • ASubmitting a request to delete a file by changing the 'file_id' parameter to a value belonging to another user.
   • BUsing a brute-force tool to guess a user's password.
   • CInjecting a malicious script into a comment field.
   • DSending a crafted link to an administrator to change their email address.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst is testing a web application for IDOR. The application uses a REST API with endpoints like /api/users/{id}/profile. The analyst wants to automate the discovery of IDOR vulnerabilities across many user IDs. Which tool or technique is most appropriate?

   • AUse Burp Suite's Intruder to fuzz the {id} parameter with a list of sequential numbers while authenticated as a test user.
   • BRun Nmap with the http-enum script to enumerate web directories.
   • CUse Wireshark to capture network traffic and analyze packet headers.
   • DManually test each user ID one by one without any tool.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A web application allows users to upload and view their own documents. A security review finds that the download endpoint /download?file=123 uses the file ID directly. The team decides to implement an indirect reference map. What additional control is still necessary?

   • AUsing a CDN to serve the files
   • BServer-side authorization checks to verify the user owns the file
   • CEncrypting the file contents on the server
   • DClient-side JavaScript to validate the file ID
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which automated technique is commonly used to discover IDOR vulnerabilities?

   • APerforming a DNS zone transfer.
   • BUsing a password cracking tool.
   • CRunning a port scan on the web server.
   • DFuzzing object identifiers in requests with sequential or predictable values.
   Reveal Solution Discussion Select an answer first