IDOR testing that proves cross-account access

What IDOR is

Almost every request your app makes carries an identifier: /orders/1042, ?user=88, an invoice UUID, a file key. An IDOR exists when the server trusts that identifier without checking that the person asking is allowed to have it. Increment it, swap it, or replay someone else's, and their data comes back.

• Sequential IDs (1042 → 1043) — the classic, easiest to exploit
• UUIDs and slugs — harder to guess, but leaked in links, exports, referrers or other responses
• Nested and second-order references — an ID buried in a body, a webhook, or a later step of a flow

Why scanners miss it, and humans are slow

A vulnerability scanner has no accounts and no idea who owns object 1042, so it cannot tell a legitimate response from a stolen one. A human tester can, but doing it by hand across every endpoint, role and object type is exactly the tedious, repetitive work people skip under time pressure. This is where an agent that never gets bored wins.

How Sintropyc tests it

Sintropyc is an autonomous AI penetration testing agent. It signs in as real users across different roles, drives your product the way a customer would, and proves every finding with a working exploit — never a scanner guess. Each finding is checked by a human before it reaches you, comes with the exact fix, and is attacked again after you ship it to confirm it held.

For IDOR it uses at least two accounts, maps every endpoint that takes an identifier, and systematically tries each account's objects from the other's session — reads and state-changing writes. A finding is only reported when account A demonstrably reaches account B's data, with the exact request and response as proof.

What you get

• Every object-bearing endpoint tested across roles
• Proven cross-account read and write, not just "possible"
• Severity based on what was actually reachable
• The fix (authorization on the object, not the route) and a retest

Common questions