Which vulnerability bypasses strict access controls to reach sensitive files?
A penetration tester observes an application enforcing strict access controls. Which of the following would allow the tester to bypass these controls and successfully access the organization’s sensitive files?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests your ability to distinguish access-control bypass mechanisms from input-based attacks; the trap is confusing IDOR with SQLi or XSS, which have different root causes and impact.
Insecure Direct Object References (IDOR) let attackers bypass authorization by manipulating object identifiers, a top application security flaw. Community consensus confirms option D, explaining that IDOR occurs when direct access to objects is based on user input without proper access checks.
Choosing SQL injection (C) or XSS (B) is common because they are well-known web vulnerabilities, but they do not directly bypass authorization by manipulating object references; the correct answer is D because IDOR specifically exploits missing checks on object identifiers.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Insecure Direct Object References (IDOR) occur when an application exposes internal object identifiers (e.g., file paths, database keys, IDs) in URLs or parameters without verifying the user's authorization. An attacker can change an ID to access another user's or organization's sensitive files, bypassing strict access controls. This matches the scenario perfectly: the tester observes strict access controls but can still access sensitive files by tampering with object references.Why the Other Options Are Wrong
Remote file inclusion (A) is about including external files, not directly bypassing access controls to internal objects. Cross-site scripting (B) is a client-side injection that doesn't directly bypass server-side authorization. SQL injection (C) targets the database layer and can lead to data theft, but it exploits a query flaw, not a missing access control check on object references—the question specifically highlights 'strict access controls,' pointing to IDOR.Community Comment Notes
Comment [3] provides a concise definition: 'Insecure direct object references occur when an application provides direct access to objects based on user input, allowing attackers to bypass authorization and access sensitive files directly.' Comment [1] adds a practical example of modifying a URL to access restricted resources, reinforcing the idea that IDOR is about knowing or guessing the reference. All voters selected D, showing consensus.Official Reference
Exam Strategy
When asked about bypassing access controls, focus on authorization flaws (IDOR, missing function-level access control) rather than injection flaws. Look for keywords like 'object references,' 'IDs,' or 'direct access via user input' to identify IDOR.