> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-10.md). # lab-10 ## Insecure Direct Object References (IDOR) **Difficulty:** Apprentice ### Lab Description This lab stores user chat logs directly on the server's file system and retrieves them using static URLs. **Objective:** Find the password for the user `carlos` and log in to their account. ### Root Cause The server uses easily guessable, sequential file names for chat transcripts. The logged-in user's session is not verified when a download request is made, so any user can download any transcript by guessing the file name. Additionally, a chat log between users should never contain sensitive data such as passwords. ### Exploitation Access the lab and open the **Live Chat** feature. Send a few messages and click **View Transcript** — this downloads a `.txt` file containing the chat history. Capture all requests in Burp Suite and find the download request: ``` GET /download-transcript/2.txt ``` Send this to Repeater. Since the first download was `2.txt`, there is likely a `1.txt` already on the server. Change the file name to `1.txt` and send: ``` GET /download-transcript/1.txt ``` The response returns a previous chat between `carlos` and another user, in which Carlos discloses his password. Use it to log in as `carlos` and complete the lab. ### Lesson Learned Whenever you encounter a file download endpoint, capture the request in Burp and ask: * Is the session being verified against the requested resource? * Are the file names sequential, predictable, or following a guessable pattern? If yes to either, try accessing other files in the same format — you may find sensitive data belonging to other users. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-10.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.