Access Control / IDOR

Cross-platform resources for Access Control / IDOR: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice Access Control / IDOR: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 24 challenges across 3 platforms — 1 HackTheBox · 14 PortSwigger · 9 TryHackMe. 1 with a Spanish writeup, 3 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Bypassing access controls using email address parsing discrepancies (Apprentice) · 🇬🇧
2. PortSwigger — Insecure direct object references (Apprentice) · 🇬🇧
3. PortSwigger — Unprotected admin functionality (Apprentice) · 🇬🇧
4. PortSwigger — Unprotected admin functionality with unpredictable URL (Apprentice) · 🇬🇧
5. PortSwigger — User ID controlled by request parameter (Apprentice) · 🇬🇧
6. PortSwigger — User ID controlled by request parameter with data leakage in redirect (Apprentice) · 🇬🇧 📹

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/access-control

HTB machines practicing Access Control / IDOR (1)

Machine	OS	Difficulty	Writeup
Cache	Linux	MEDIUM	🇪🇸 🇬🇧 📹

PortSwigger labs practicing Access Control / IDOR (14)

Lab	Difficulty	Topic	Official
Bypassing access controls using email address parsing discrepancies	APPRENTICE	Business Logic Vulnerabilities	Open
Insecure direct object references	APPRENTICE	Access Control Vulnerabilities	Open
Unprotected admin functionality	APPRENTICE	Access Control Vulnerabilities	Open
Unprotected admin functionality with unpredictable URL	APPRENTICE	Access Control Vulnerabilities	Open
User ID controlled by request parameter	APPRENTICE	Access Control Vulnerabilities	Open
User ID controlled by request parameter with data leakage in redirect	APPRENTICE	Access Control Vulnerabilities	Open
User ID controlled by request parameter with password disclosure	APPRENTICE	Access Control Vulnerabilities	Open
User ID controlled by request parameter, with unpredictable user IDs	APPRENTICE	Access Control Vulnerabilities	Open
User role can be modified in user profile	APPRENTICE	Access Control Vulnerabilities	Open
User role controlled by request parameter	APPRENTICE	Access Control Vulnerabilities	Open
Method-based access control can be circumvented	PRACTITIONER	Access Control Vulnerabilities	Open
Multi-step process with no access control on one step	PRACTITIONER	Access Control Vulnerabilities	Open
Referer-based access control	PRACTITIONER	Access Control Vulnerabilities	Open
URL-based access control can be circumvented	PRACTITIONER	Access Control Vulnerabilities	Open

TryHackMe rooms practicing Access Control / IDOR (9)

Room	Difficulty	Type	Access	Official
Advent of Cyber 2022	EASY	Walkthrough	🟢 Free	Open
Advent of Cyber 3 (2021)	EASY	Walkthrough	🟢 Free	Open
Broken Access Control	EASY	Walkthrough	🟢 Free	Open
Corridor	EASY	Challenge	🟢 Free	Open
IDOR	EASY	Walkthrough	🔵 VIP	Open
Introduction to CryptOps	EASY	Walkthrough	🟢 Free	Open
XDR: Introduction	MEDIUM	Walkthrough	🟢 Free	Open
envizon	HARD	Challenge	🟢 Free	Open
Hacking Hadoop	HARD	Walkthrough	🟢 Free	Open

---

← Back to the full glossary

Last updated: 2026-08-17