Skip to content
Hugin capabilities

How to test broken access control and IDOR

Broken access control is the most common high-impact bug class — and the one scanners handle worst, because it depends on what the app is supposed to allow. The method is systematic: two accounts, replay, compare.

The method

  1. 1

    Use two accounts

    Create two low-privilege accounts you control. Access-control bugs are invisible with one — you need a second identity to test whether A can reach B's data, and whether a low-privilege user can reach admin function.

  2. 2

    Harvest every request the client makes

    Drive the app through both accounts and capture all API calls. The hidden endpoints and object IDs are in the XHR traffic, not the rendered page.

  3. 3

    Replay each request from the other account

    Take each authenticated request and resend it with account B's session while pointing at account A's identifiers. A 200 with A's data is an IDOR; a state change is worse.

  4. 4

    Strip client-side guards

    Disabled buttons and hidden routes are cosmetic. Replay the request they guard directly against the server — if the server does not enforce the check, the protection never existed.

  5. 5

    Test vertical escalation

    Replay admin-only endpoints with a low-privilege session. Also try changing a role or permission field in your own profile update — mass assignment often grants more than intended.

Do it in Hugin

Hugin captures every request into a searchable history and lets you swap sessions and replay in the Repeater in one click, with scanner checks for the access-control classes that are testable automatically — the manual replay loop is the core workflow, not an afterthought.

Vulnerability scanner capability

Frequently asked

What is the difference between IDOR and broken access control?

IDOR is a specific broken-access-control bug where an object reference you can change exposes another user's data. Broken access control is the broader class, including vertical escalation and missing function-level checks.

Why do scanners miss broken access control?

Because it depends on intent: the endpoint behaves exactly as coded. Only by replaying with a different identity and knowing what the data should be can you tell that the server failed to enforce a rule.

Put the method into a tool

Hugin is free to download, no account.

Download Hugin

More guides