During an assessment, a penetration tester Inspected a log and found a series of thousands of requests coming from a single IP address to the same URL. A few of the requests are listed below: Which…

The correct answer is D. Insecure direct object reference. Insecure Direct Object Reference (IDOR) occurs when an application exposes internal object identifiers (such as database IDs or filenames) directly in URLs, allowing attackers to enumerate and access unauthorized resources by manipulating those values. The pattern described…

Attacks and Exploits

Question

During an assessment, a penetration tester Inspected a log and found a series of thousands of requests coming from a single IP address to the same URL. A few of the requests are listed below:

Which of the following vulnerabilities was the attacker trying to exploit?

Exhibit

Options

ASession hijacking
BURL manipulation
CSQL injection
DInsecure direct object reference

How the community answered

(33 responses)

A
3% (1)
B
12% (4)
C
6% (2)
D
79% (26)

Explanation

Insecure Direct Object Reference (IDOR) occurs when an application exposes internal object identifiers (such as database IDs or filenames) directly in URLs, allowing attackers to enumerate and access unauthorized resources by manipulating those values. The pattern described - thousands of sequential or iterated requests to the same URL endpoint from a single IP - is the hallmark of an IDOR enumeration attack, where the attacker cycles through object references (e.g., ?id=1, ?id=2, ?id=3…) hoping to access records they are not authorized to view. Session hijacking involves stealing session tokens, URL manipulation is a broader category, and SQL injection targets database query logic rather than object reference enumeration.

Topics

#Insecure Direct Object Reference (IDOR)#Web Vulnerabilities#Log Analysis#Automated Exploitation

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice