User ID Controlled by Request Parameter | Broken Access Control | PortSwigger Lab-05

In this video, I demonstrate how the User ID Controlled by Request Parameter vulnerability can be exploited, which is a classic case of Broken Access Control and Insecure Direct Object Reference (IDOR) as outlined in OWASP Top 10 (A01).

The application relies on a user-controlled request parameter (such as userId or uid) to identify which user’s data should be accessed. By modifying this parameter, an attacker can access or manipulate other users’ accounts and sensitive information without authorization.

🔍 What you will learn:

What Broken Access Control and IDOR are

Why trusting user-controlled identifiers is dangerous

How attackers manipulate request parameters to access other users’ data

Horizontal and vertical privilege escalation

Real-world impact of IDOR vulnerabilities

Proper mitigation and secure access control practices

This lab is solved using the PortSwigger Web Security Academy, making it ideal for web security learners and bug bounty hunters.

⚠️ Disclaimer:
This video is for educational purposes only. Do not attempt these techniques on systems without proper authorization.

🔐 Vulnerability Category

Broken Access Control (OWASP A01)

Insecure Direct Object Reference (IDOR)

🧪 Lab Platform

PortSwigger Web Security Academy.

#BrokenAccessControl
#IDOR
#UserIDManipulation
#RequestParameter
#WebSecurity
#EthicalHacking
#PortSwigger
#OWASPTop10
#BugBounty
#CyberSecurity
#WebApplicationSecurity
#HackingLabs

Видео User ID Controlled by Request Parameter | Broken Access Control | PortSwigger Lab-05 канала Hacking Bangla