Insecure direct object reference (null delhi meet)
1 like1,085 views
This document discusses insecure direct object references (IDOR), a type of access control vulnerability. IDOR occurs when an application exposes references to unauthorized resources, such as allowing access to another user's account, through direct manipulation of the reference URL or parameter. The document explains how IDOR works using examples, how attackers can discover and exploit IDOR vulnerabilities, and considerations for when it may not be critical even if present. It also provides resources for further information on testing and remediating IDOR issues.
Insecure direct object reference (null delhi meet)
- 1. Insecure Direct Object Reference What, Why, and How? Presented by, Abhinav Mishra Founder, ENCIPHERS www.enciphers.com
- 2. First thing’s first. Why IDOR? Why talk about a vulnerability like IDOR when there are more intense attacks like SQL Injection and Remote Code Execution? ● Exploitation is cool ● Very common in Rest API ● Scanners are useless in discovering them ● High impact ● Great bounty
- 3. Also... Can’t see IDOR in OWASP TOP 10 2017?
- 4. What is IDOR? Consider a URL for deleting the profile pic of a certain user: https://samplesite.com/deleteProfilePic?id=127 If the application is vulnerable to IDOR: https://samplesite.com/deleteProfilePic?id=128 Will delete the Profile Pic of Another User having the id of “128”
- 5. So what is an Object? ● Any user data/information like, pictures, profile, account, files etc ● Social Network: ○ Posts, users (blocked?), videos, pics, friends etc ● Ecommerce: ○ Credit card, private info, cart ● Other: ○ Messages, private posts, friends, files, documents etc
- 6. Another bad example... Let’s suppose this is the URL which you get when you want to see your purchases from your favorite e-commerce site: https://ecommercesite.com/purchase.html?uid=25673 What if the application is vulnerable to IDOR: https://ecommercesite.com/purchase.html?uid=25675 Will show the purchases for some other User whose user id is “25675”
- 7. So, how to find these? ● Capture all the traffic in a proxy ● Find all the requests (GET or POST) which has any object identifier like id, pid, uid etc ● Create another account and get the identifiers from both accounts. ● Use one of the account’s sessions/auth header and replay each request with the object identifier from another account. ● Can you access/edit any of the object from another account? ● Report bug, get paid (if not duplicate)
- 8. When it’s not actually critical? When the identifiers are like 2896519846826592fgweut924293 You can’t actually guess the other identifiers, then how would you access them? So? Is it no more a vulnerability?
- 9. Actually it still can be.. Try to find a way to get other’s identifier values? Example: /api/v2/users/ Or /api/v2/files/ These may not give details of the files, but may give the file identifiers and name etc.
- 10. Resources? Bugcrowd Blog: Link Owasp Link How to test (Burp Suite): Link Need help? Find me @0ctac0der