Simple IDOR with Incremental Numeric IDs

A minimal Flask application demonstrating an insecure direct object reference (IDOR) vulnerability caused by using sequential integer identifiers in URLs without any access control or authentication.

Objectives

• Identify insecure resource access using numeric IDs
• Understand the risk of exposing data without authentication
• Perform manual IDOR attacks using integer incrementation
• Capture and report unauthorized data access

Difficulty

Beginner

Estimated Time

20–30 minutes

Prerequisites

• Basic knowledge of HTTP and URLs
• Ability to modify URL paths manually
• Familiarity with curl, a browser, or BurpSuite

Skills Learned

• IDOR discovery and exploitation
• Enumerating numeric resource identifiers
• Understanding the consequences of missing authorization checks
• Performing manual fuzzing

Project Structure

• build/ — Flask application code (app.py, templates/, static/)
• deploy/ — Docker configuration files
• test/ — Automated tests
• docs/ — Documentation

Quick Start

Prerequisites

• Docker and docker-compose

Installation

1. Clone the repository
2. Run the application:

   docker-compose up --build

3. Open http://localhost:3206 in your browser

Issue Tracker

https://github.com/cyberctf/idor-flask/issues

---