Skip to content

Latest commit

 

History

History
32 lines (20 loc) · 1.49 KB

insecure-direct-object-references-idor.md

File metadata and controls

32 lines (20 loc) · 1.49 KB
Raw
description

Insecure Direct Object References (IDOR)

Level: Apprentice

What's an IDOR?

  • Insecure direct object references (IDOR) are a subcategory of access control vulnerabilities.
  • IDOR arises when an application uses user-supplied input to access objects directly and an attacker can modify the input to obtain unauthorized access.

  • Here we have a live chat, and we can click on the function transcript to download our conversation
  • Intercepting the request, you'll see a 302-status code, just follow the redirection.

  • We see that we are downloading a file called 6.txt.
  • Let's try to access other conversations by changing our 6.txt to 1.txt.

  • When we change the number, we can 'accidentally' get another transcript.
  • In the 1.txt is filtering the Carlos conversation to recover the password, so copied and log in.