search

6. IDOR 0x01

When we test for IDORs the best practice is after we identified something like a user id in the URL of the account page to create 2 different users where we can test for this specific type of vulnerability.

That is important to do because of the impact that the bug search creates. First, things first we won't get to access live user data and if the IDOR works it can be safely assumed we can replicate that with any other user. In this case we don't affect other live users, or the development team.

hashtag
Method 1 - burpsuite

  • We capture the request Proxy > HTTP History

  • Send the GET request to Repeater

  • Check the request in the repeater and change the id for userid to see if it works.

hashtag
Method 2- ffuf

ffuf -u 'http://localhost/labs/e0x02.php?account=FUZZ' -w num.txt -mr 'admin'

-mr is used to filter by regex over word 'admin'

Previous5. Introduction to AuthorizationNext7. Introduction to APIs