Explanation of a simple IDOR

[xoredserpent]

Exploiting Insecure Direct Object Reference (IDOR) is a simple yet effective technique that could be very effective especially in combination with other techniques ex some header manioulation. So IDOR as an example we make a request that is http://nordicbank.com/account?id=1234 we will get the profile of the persons account which the id is 1234. After that we can then send another request which could be for example http://nordicbank.com/account?id=1235 if there is no authentication on the server side we would receive the account belonging to id 1235.