IDOR - Horizontal Scanner
Detects insecure direct object references allowing access to other users' data.
What is IDOR - Horizontal?
Horizontal IDOR occurs when users can access other users' data by manipulating object identifiers (IDs) in requests. For example, changing /api/users/123/profile to /api/users/124/profile might expose another user's private information without proper authorization checks.
Why is This Important?
Horizontal IDOR is extremely common and leads to mass data exposure. A single vulnerable endpoint can leak all users' personal data, payment information, private messages, or any user-specific content. It violates user privacy and often triggers compliance violations.
How It Works
1. Web Crawling
Intelligent crawling discovers all endpoints, forms, parameters, and dynamic content across your web application.
2. Payload Injection
AI-powered payloads test each input vector for web vulnerabilities with context-aware attack patterns.
3. Response Analysis
Advanced analysis detects vulnerability signatures in responses, confirming exploitability with proof-of-concept.
Key Capabilities
Industry-leading web security testing powered by AI, trusted by security teams worldwide for accurate vulnerability detection.
- Deep web crawling with JavaScript rendering support
- Context-aware payload generation for each parameter
- False positive elimination through response analysis
- OWASP Top 10 and CWE compliance mapping
- Seamless CI/CD and DevSecOps integration
Frequently Asked Questions
Why is IDOR so common?
Developers often focus on authentication (is user logged in?) but forget authorization (should this user access this specific resource?). IDOR happens when authorization checks are missing or incomplete.
What identifiers are commonly vulnerable?
User IDs, document IDs, order numbers, invoice IDs, message IDs, account numbers, and any predictable or sequential identifier in URLs or request parameters.
How do attackers find IDOR vulnerabilities?
By creating two accounts and attempting to access one account's resources while logged into the other. Automated tools can fuzz ID parameters to find accessible resources.
Do UUIDs prevent IDOR?
UUIDs make enumeration harder but don't prevent IDOR. Leaked UUIDs (in logs, URLs, or other responses) can still be exploited. Proper authorization checks are essential.
Related Scanners
Ready to secure your application?
Start testing for idor - horizontal vulnerabilities today.
Get Started Free