Learn how a lack of authorization checks in a Flask application's download endpoint can allow attackers to access or exfiltrate other users' files.
- Username:
alice - Password:
alicepass
- Identify endpoints vulnerable to IDOR
- Craft and send unauthorized resource access requests
- Verify access to data owned by other users
Beginner
30 minutes
- Basic Flask knowledge
- HTTP fundamentals
- Familiarity with browser developer tools or curl
- Finding and exploiting IDOR in Flask routes
- Testing for insufficient access control
- Validating and reporting sensitive data exposure
- folder: build
- folder: deploy
- folder: test
- folder: docs
- file: README.md
- file: .gitignore
Prerequisites: Docker or Python 3 with virtualenv installed.
Installation:
git clone <repo-url>
cd flask-idor-lab
docker-compose up
# or:
pip install -r build/requirements.txt
cd build
flask run