Automated black-box detection of Insecure Direct Object Reference (IDOR) vulnerabilities in web applications

Abstract

Broken authentication and access control are among the most critical vulnerabilities in web applications, often enabling attackers to bypass security mechanisms and gain unauthorized access. A notable instance of this class of weakness is the Insecure Direct Object Reference (IDOR) vulnerability, where object identifiers in client requests can be manipulated to expose or modify restricted resources. Despite its significance, IDOR remains difficult to detect automatically. Existing scanners are limited in scope, focusing mainly on HTTP GET and POST methods, requiring manual intervention, and often producing high false positive rates with lengthy information-gathering phases. To address these limitations, we present IDORD, a fully automated black-box tool for IDOR detection. IDORD incorporates a crawler for automated URL extraction, applies parameter mutation to craft unauthorized requests, and analyzes response behaviors to identify violations of access control policies. Unlike conventional scanners, our approach systematically evaluates all major HTTP methods, including GET, POST, PUT, and DELETE. Validation on deliberately vulnerable applications shows that IDORD improves efficiency, reduces detection time, and provides broader coverage of IDOR vulnerabilities compared to existing approaches.