Scopus Indexed Publications

Paper Details


Title
Automated Black-Box Detection of Insecure Direct Object Reference (IDOR) Vulnerabilities in Web Applications

Author
Ayemun Hossain, Bibi Kawsar,

Email

Abstract

Broken authentication and access control are among the most critical vulnerabilities in web applications, often enabling attackers to bypass security mechanisms and gain unauthorized access. A notable instance of this class of weakness is the Insecure Direct Object Reference (IDOR) vulnerability, where object identifiers in client requests can be manipulated to expose or modify restricted resources. Despite its significance, IDOR remains difficult to detect automatically. Existing scanners are limited in scope, focusing mainly on HTTP GET and POST methods, requiring manual intervention, and often producing high false positive rates with lengthy information-gathering phases. To address these limitations, we present IDORD, a fully automated black-box tool for IDOR detection. IDORD incorporates a crawler for automated URL extraction, applies parameter mutation to craft unauthorized requests, and analyzes response behaviors to identify violations of access control policies. Unlike conventional scanners, our approach systematically evaluates all major HTTP methods, including GET, POST, PUT, and DELETE. Validation on deliberately vulnerable applications shows that IDORD improves efficiency, reduces detection time, and provides broader coverage of IDOR vulnerabilities compared to existing approaches.


Keywords

Journal or Conference Name
2025 IEEE 4th International Conference on Robotics, Automation, Artificial-Intelligence and Internet-of-Things, RAAICON 2025

Publication Year
2025

Indexing
scopus