00 — Overview
IDOR — Going Deeper
You know how to change a number in a URL. Now learn how to find IDOR in API responses, enumerate IDs automatically with the fuzzer, and access data hidden behind requests your browser never shows you.
Beginner·40 min·5 tasks
// By the end of this module
→Use an intercepting proxy to manipulate object reference parameters live
→Find non-obvious IDOR in encoded IDs, GUIDs, and indirect references
→Automate IDOR testing with Burp Intruder across ID ranges
→Combine IDOR with privilege escalation on a real target