> For the complete documentation index, see [llms.txt](https://gowthams.gitbook.io/bughunter-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gowthams.gitbook.io/bughunter-handbook/list-of-vulnerabilities-bugs/insecure-direct-object-references-idor.md).

# Insecure Direct Object References (IDOR)

**Blogs / Articles / Write-ups:**

* <https://www.notion.so/IDOR-Attack-vectors-exploitation-bypasses-and-chains-0b73eb18e9b640ce8c337af83f397a6b>
* <https://www.aon.com/cyber-solutions/aon_cyber_labs/finding-more-idors-tips-and-tricks/>
* <https://portswigger.net/support/using-burp-to-test-for-insecure-direct-object-references>

{% embed url="<https://twitter.com/e11i0t_4lders0n/status/1434735929617371140?s=20>" %}

Looking for high impact IDOR? Always try to find the hidden parameters for this endpoints using Arjun and Parameth /settings/profile /user/profile /user/settings /account/settings /username /profile And any payment endpoint Thanks[@Synack](https://twitter.com/synack) [#bugbountytip](https://twitter.com/hashtag/bugbountytip?src=hashtag_click) [#bugbountytips](https://twitter.com/hashtag/bugbountytips?src=hashtag_click) [#Bugbounty](https://twitter.com/hashtag/Bugbounty?src=hashtag_click)

Tool:

* <https://github.com/0xsapra/fuzzparam>

![https://twitter.com/muffymas/status/1408054941445353472?s=20](/files/-Ml-GI_zHQbNiPnxekkz)

* <https://www.notion.so/IDOR-Attack-vectors-exploitation-bypasses-and-chains-0b73eb18e9b640ce8c337af83f397a6b>
* <https://16521092.medium.com/some-ways-to-find-more-idor-da16c93954e5>
* <https://monke.ie/oauth-idor-pii/>