Insecure Direct Object Reference (IDOR) — TryHackMe IDOR Room

📰 Medium · Cybersecurity

Learn to identify and exploit Insecure Direct Object Reference (IDOR) vulnerabilities in web applications, a high-severity issue that can lead to unauthorized data access.

intermediate Published 21 Jun 2026

Action Steps

Identify potential IDOR vulnerabilities by analyzing background API requests in a web application.
Manipulate object identifiers in API requests to test for unauthorized data access.
Use tools like Burp Suite or ZAP to intercept and modify HTTP requests.
Exploit the IDOR vulnerability to access sensitive data, if possible.
Report and document the vulnerability, including steps to reproduce and recommended fixes.

Who Needs to Know This

Security teams and penetration testers can benefit from understanding IDOR vulnerabilities to improve web application security and protect against unauthorized data access.

Key Insight

💡 IDOR vulnerabilities can be exploited by manipulating object identifiers in background API requests, allowing attackers to access unauthorized data.

Key Takeaways

Learn to identify and exploit Insecure Direct Object Reference (IDOR) vulnerabilities in web applications, a high-severity issue that can lead to unauthorized data access.

Full Article

Title: Insecure Direct Object Reference (IDOR) — TryHackMe IDOR Room

URL Source: https://kirll0s.medium.com/insecure-direct-object-reference-idor-tryhackme-idor-room-b238900fef0e?source=rss------cybersecurity-5

Published Time: 2026-06-21T00:32:02Z

Markdown Content:
# Insecure Direct Object Reference (IDOR) — TryHackMe IDOR Room | by Kyrillos Kamal | Jun, 2026 | Medium

[Sitemap](https://kirll0s.medium.com/sitemap/sitemap.xml)

[Open in app](https://play.google.com/store/apps/details?id=com.medium.reader&referrer=utm_source%3DmobileNavBar&source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fkirll0s.medium.com%2Finsecure-direct-object-reference-idor-tryhackme-idor-room-b238900fef0e&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)

[](https://medium.com/?source=post_page---top_nav_layout_nav-----------------------------------------)

Get app

[Write](https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---top_nav_layout_nav-----------------------new_post_topnav------------------)

[Search](https://medium.com/search?source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fkirll0s.medium.com%2Finsecure-direct-object-reference-idor-tryhackme-idor-room-b238900fef0e&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)

![Image 1: Unknown user](https://miro.medium.com/v2/resize:fill:32:32/1*dmbNkD5D-u45r44go_cf0g.png)

# Insecure Direct Object Reference (IDOR) — TryHackMe IDOR Room

[![Image 2: Kyrillos Kamal](https://miro.medium.com/v2/resize:fill:32:32/1*37RLe4NwIu3lkOw0NKuDew.jpeg)](https://kirll0s.medium.com/?source=post_page---byline--b238900fef0e---------------------------------------)

[Kyrillos Kamal](https://kirll0s.medium.com/?source=post_page---byline--b238900fef0e---------------------------------------)

2 min read

·

Just now

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2Fb238900fef0e&operation=register&redirect=https%3A%2F%2Fkirll0s.medium.com%2Finsecure-direct-object-reference-idor-tryhackme-idor-room-b238900fef0e&user=Kyrillos+Kamal&userId=4d9bbdab235f&source=---header_actions--b238900fef0e---------------------clap_footer------------------)

--

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Frepost%2Fp%2Fb238900fef0e&operation=register&redirect=https%3A%2F%2Fkirll0s.medium.com%2Finsecure-direct-object-reference-idor-tryhackme-idor-room-b238900fef0e&user=Kyrillos+Kamal&userId=4d9bbdab235f&source=---header_actions--b238900fef0e---------------------repost_header------------------)

--

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fb238900fef0e&operation=register&redirect=https%3A%2F%2Fkirll0s.medium.com%2Finsecure-direct-object-reference-idor-tryhackme-idor-room-b238900fef0e&source=---header_actions--b238900fef0e---------------------bookmark_footer------------------)

[Listen](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2Fplans%3Fdimension%3Dpost_audio_button%26postId%3Db238900fef0e&operation=register&redirect=https%3A%2F%2Fkirll0s.medium.com%2Finsecure-direct-object-reference-idor-tryhackme-idor-room-b238900fef0e&source=---header_actions--b238900fef0e---------------------post_audio_button------------------)

Share

## 1. Overview

In this report, I document the discovery of an Insecure Direct Object Reference (IDOR) vulnerability within the web application provided in the TryHackMe IDOR room. This vulnerability allows an attacker to access unauthorized data by manipulating object identifiers in background API requests.

## 2. Vulnerability Details

* Vulnerability Name: Insecure Direct Object Reference (IDOR) / Broken Access Control
* Severity: High
*

Read full article → ← Back to Reads

Insecure Direct Object Reference (IDOR) — TryHackMe IDOR Room

Key Takeaways

Full Article

Related Videos