IDOR — Predictable Resource ID

Scenario

AcmeBilling lets each customer view their own invoices at ?invoice=<number>. The application does not check whether the invoice belongs to the user — it just returns whatever invoice has that ID.

You are logged in as customer #14 with access to invoice #1042. There is another invoice somewhere in the system that contains a flag value. Find it.

The flag has the shape TC{idor_…}.

Primer — why this works

The app does, server-side:

function getInvoice(id) {
  return db.invoices.find(inv => inv.id === Number(id));   // ← no ownership check
}

A real fix would compare inv.customer_id === currentUser.id before returning the row. Without that check, anyone can request anyone else's invoice by guessing the ID.

Steps

1. Open the lab. Note that ?invoice=1042 shows your own invoice.
2. Change the number in the URL. Try sequential values — 1041, 1043, 1044…
3. One of the invoices contains the flag string.
4. Paste the flag below.

Tips

• IDs in this lab live in the range 1040–1060. You don't need a script — six clicks will do.
• In a real engagement you'd note this as CWE-639: Authorization Bypass Through User-Controlled Key.

Acceptance

• You find the invoice that contains a TC{idor_…} payload.
• Submitted hash matches.