Typorithm · hard

IDOR, SSRF & XXE

web-vulnspentestidorssrfxxe

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn IDOR, SSRF & XXE

Web App Testing

IDOR is broken access control from changing an object id; SSRF tricks the server into fetching an attacker URL (often cloud metadata at 169.254.169.254); XXE abuses a parser that resolves external entities. These high-impact logic flaws are found manually during authorized testing, and the fixes are server-side authorization checks, URL allow-lists, and disabling external entities in the XML parser.

IDOR (Insecure Direct Object Reference) is a form of broken access control: a request like /account/123 is changed to /account/124 and, if the server skips an ownership check, returns another user's data. Endpoint discovery tools like ffuf help find candidate objects, but the bug is the missing authorization, fixed by checking that the current user owns the object on every request.

SSRF (Server-Side Request Forgery) makes the server issue a request to an attacker-controlled URL. A classic target is the cloud metadata service at 169.254.169.254, which can leak instance credentials. The remediation is an allow-list of permitted hosts, blocking internal and link-local ranges, and not reflecting raw responses.

XXE (XML External Entity) injection abuses an XML parser configured to resolve external entities, letting an XML body read local files or trigger SSRF. The fix is to disable external entity and DTD processing in the parser. Across all three, server-side authorization and strict input handling are the durable defenses.

IDOR: missing ownership check on a referenced object id.

SSRF: server fetches an attacker URL, often cloud metadata.

XXE: parser resolves external entities — disable them.

# IDOR: change /account/123 to /account/124
# SSRF: url=http://169.254.169.254/ (metadata)
ffuf -u https://t/api/FUZZ -w params.txt
# XXE: external entity in an XML body

Read the implementation

Connect each part of the code to the concept before you type.

1. IDOR test

Insecure Direct Object Reference: incrementing an object id to reach another user's record reveals missing authorization checks.

# IDOR: change /account/123 to /account/124

2. SSRF probe

Server-Side Request Forgery makes the server fetch an attacker URL; 169.254.169.254 is the cloud metadata endpoint testers check for credential exposure.

# SSRF: url=http://169.254.169.254/ (metadata)

3. Fuzz endpoints

ffuf substitutes FUZZ with each word in the list to discover hidden endpoints and parameters worth testing for access-control flaws.

ffuf -u https://t/api/FUZZ -w params.txt

4. XXE vector

XML External Entity injection abuses a parser that resolves external entities, enabling file reads or SSRF from an XML body.

# XXE: external entity in an XML body

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.