During a penetration test, a tester is able to change values in the URL from example.com/login.php?id=5 to example.com/login.php?id=10 and gain access to a web application. Which of the following…

The correct answer is C. Direct object reference. Insecure direct object reference (IDOR) is a vulnerability where the developer of the application does not implement authorization features to verify that someone accessing data on the site is allowed to access that data.

Attacks and Exploits

Question

During a penetration test, a tester is able to change values in the URL from example.com/login.php?id=5 to example.com/login.php?id=10 and gain access to a web application. Which of the following vulnerabilities has the penetration tester exploited?

Options

ACommand injection
BBroken authentication
CDirect object reference
DCross-site scripting

How the community answered

(18 responses)

A
6% (1)
B
6% (1)
C
72% (13)
D
17% (3)

Explanation

Insecure direct object reference (IDOR) is a vulnerability where the developer of the application does not implement authorization features to verify that someone accessing data on the site is allowed to access that data.

Topics

#Direct Object Reference#Broken Access Control#Web application security#Penetration testing

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice