Stage 6 beginner
Who Can See This? (IDOR)
Being logged in doesn't mean you can read every account. Find the missing checks, then test the fix.
Runs in your browser. Nothing to install — the lesson and a real Linux computer open side by side.
Start Stage 6 → Get Chapter 2 · $24 →One payment unlocks all four stages: Logins and Sessions, IDOR, SQL injection and XSS. Yours to keep, no subscription.
Already bought it? Sign in
Lesson steps
- Welcome
- Carry your login
- Were you charged twice?
- Change the number
- A customer reading staff records
- Follow the attachment
- Your account, their invoice
- Does the attachment still open?
- Final challenge: sign off every route
- Stage complete
What this stage is
The bakery uses a made-up payment service called QuickPay. As Alice, a customer investigating a duplicate charge, you'll follow an account to its invoices. Then you'll find out whether the same login lets you read other customers' notes and confidential staff documents.
You'll change one part of a request at a time and compare the results. This missing permission check is called IDOR: a site looks up the record you asked for without checking whether you're allowed to see it.
Why it matters
A login answers who you are. The server still needs to check which records you may read. Hiding a link or choosing a hard-to-guess account number doesn't replace that check.
You'll follow an account to its invoice and attached document, then test what happens when an invoice is requested under the wrong account. Every record needs its own permission check.
By the end you'll be able to
- send a login token with a request and read the data returned
- compare access to your own records and someone else's
- check linked invoices and documents, including a mismatched account and invoice
- verify that a fixed service refuses private records while your own records still open
Eight flag challenges take you from your own payment trail to testing the repair. The final challenge checks the whole chain: its checklist gives you a sign-off flag once the allowed and forbidden requests behave correctly.