Access Control / IDOR

Recursos cross-platform para Access Control / IDOR: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

Esta página agrega los recursos para practicar Access Control / IDOR de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

Cobertura: 24 retos en 3 plataformas — 1 HackTheBox · 14 PortSwigger · 9 TryHackMe. 1 con writeup en español, 3 con writeup en vídeo.

​

Por dónde empezar

Ordenado por dificultad real. A igual nivel, primero el lab aislado, después la room guiada y por último la máquina completa.

1. PortSwigger — Bypassing access controls using email address parsing discrepancies (Apprentice) · 🇬🇧
2. PortSwigger — Insecure direct object references (Apprentice) · 🇬🇧
3. PortSwigger — Unprotected admin functionality (Apprentice) · 🇬🇧
4. PortSwigger — Unprotected admin functionality with unpredictable URL (Apprentice) · 🇬🇧
5. PortSwigger — User ID controlled by request parameter (Apprentice) · 🇬🇧
6. PortSwigger — User ID controlled by request parameter with data leakage in redirect (Apprentice) · 🇬🇧 📹

​

Recursos curados

Fuente	Enlace
PortSwigger	https://portswigger.net/web-security/access-control

​

Máquinas HTB que practican Access Control / IDOR (1)

Máquina	SO	Dificultad	Writeup
Cache	Linux	MEDIUM	🇪🇸 🇬🇧 📹

​

Labs PortSwigger que practican Access Control / IDOR (14)

Lab	Dificultad	Topic	Oficial
Bypassing access controls using email address parsing discrepancies	APPRENTICE	Business Logic Vulnerabilities	Abrir
Insecure direct object references	APPRENTICE	Access Control Vulnerabilities	Abrir
Unprotected admin functionality	APPRENTICE	Access Control Vulnerabilities	Abrir
Unprotected admin functionality with unpredictable URL	APPRENTICE	Access Control Vulnerabilities	Abrir
User ID controlled by request parameter	APPRENTICE	Access Control Vulnerabilities	Abrir
User ID controlled by request parameter with data leakage in redirect	APPRENTICE	Access Control Vulnerabilities	Abrir
User ID controlled by request parameter with password disclosure	APPRENTICE	Access Control Vulnerabilities	Abrir
User ID controlled by request parameter, with unpredictable user IDs	APPRENTICE	Access Control Vulnerabilities	Abrir
User role can be modified in user profile	APPRENTICE	Access Control Vulnerabilities	Abrir
User role controlled by request parameter	APPRENTICE	Access Control Vulnerabilities	Abrir
Method-based access control can be circumvented	PRACTITIONER	Access Control Vulnerabilities	Abrir
Multi-step process with no access control on one step	PRACTITIONER	Access Control Vulnerabilities	Abrir
Referer-based access control	PRACTITIONER	Access Control Vulnerabilities	Abrir
URL-based access control can be circumvented	PRACTITIONER	Access Control Vulnerabilities	Abrir

​

Rooms TryHackMe que practican Access Control / IDOR (9)

Room	Dificultad	Tipo	Acceso	Oficial
Advent of Cyber 2022	EASY	Walkthrough	🟢 Free	Abrir
Advent of Cyber 3 (2021)	EASY	Walkthrough	🟢 Free	Abrir
Broken Access Control	EASY	Walkthrough	🟢 Free	Abrir
Corridor	EASY	Challenge	🟢 Free	Abrir
IDOR	EASY	Walkthrough	🔵 VIP	Abrir
Introduction to CryptOps	EASY	Walkthrough	🟢 Free	Abrir
XDR: Introduction	MEDIUM	Walkthrough	🟢 Free	Abrir
envizon	HARD	Challenge	🟢 Free	Abrir
Hacking Hadoop	HARD	Walkthrough	🟢 Free	Abrir

---

← Volver al glosario completo

Última actualización: 2026-08-17