Authorization disclaimer. This walkthrough is exclusively for the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Only test systems you own or are explicitly authorized to assess.

Overview

The live-chat feature stores transcripts under sequential numeric filenames and serves them through a direct download route. Because the server does not check ownership, changing the filename retrieves another user’s conversation.

PortSwigger insecure direct object references lab introduction
The GET /download-transcript endpoint objective is to recover Carlos credentials from an unowned transcript.

Lab objective/setup

No account is initially provided. Recover the synthetic password disclosed in Carlos’s transcript and use it to sign in as carlos.

What I observed

The application offered live chat and a View transcript function. After sending test messages, downloading the transcript produced a file named with a simple integer, indicating a predictable object namespace.

Live chat interface with view transcript control
The View transcript control issues GET /download-transcript for a numbered chat file.
Downloaded chat transcript using a numeric filename
The /download-transcript/1.txt filename demonstrates the sequential object identifier pattern.

Why it is vulnerable

Predictability aids discovery, but the core defect is missing object-level authorization. The endpoint accepts a filename such as 1.txt without confirming that the requester owns or may read that transcript.

Walkthrough in the authorized PortSwigger lab

  1. Use live chat and download your own transcript to learn the URL format.
  2. In the lab, request /download-transcript/1.txt.
  3. Read the synthetic transcript and use the disclosed Carlos credential to sign in.
Unauthorized transcript containing Carlos synthetic password
The GET /download-transcript/1.txt response contains Carlos's synthetic credential without an ownership check.
Successful Carlos login completing the IDOR lab
Signing in to My account as carlos with the Live chat credential completes the exercise.

Verification

The server returns transcript 1.txt despite no ownership relationship, and the Academy marks the lab solved after the resulting login. The password is not reproduced because its exact value adds no educational value.

Impact and defensive lesson

Comparable flaws can disclose support conversations, credentials, personal information, or internal details. Authorize every download against the current user and resource, and avoid public sequential storage keys.

References