Insecure Direct Object References

Insecure Direct Object References occur when an application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources in the system directly, for example database records or files.


Insecure Direct Object References allow attackers to bypass authorization and access resources directly by modifying the value of a parameter used to directly point to an object. Such resources can be database entries belonging to other users, files in the system, and more. This is caused by the fact that the application takes user supplied input and uses it to retrieve an object without performing sufficient authorization checks.

How to Test

• Map out all locations in the application where user input is used to reference objects directly.
•  
• The best way to test for direct object references would be by having at least two or more users to cover different own objects and functions.
•  
• The value of a parameter is used directly to retrieve a database record.
• The value of a parameter is used directly to perform an operation in the system.
•  
• The value of a parameter is used directly to retrieve a file system resource.
•  
  
• The value of a parameter is used directly to access application functionality.

This is a vulnerable web page where you can discover a IDOR vulnerability and learn something new techniques

CAUTION: This is an intentionally broken web application. Please do NOT use any real information

In this URL, as you can see here. Here the number has been used for any one profile and here we can consider it as an object.

Let's intercept this page via burp suite and sent to the intruder tab.

The number we have taken as a object will be add mark...so lets hightlight the number and click on add button.

Now what we are doing!! so lets change the payload type thats means we select a numbers in Pyload set and after doing, we will add numbers from 1 to 100 and whatever as you want. okay!!

So in Payload Options[Numbers] we will add a number from 1 and for to 1000 and we will leave the other options as it as.

Finally Click on start attack.

So as you can there's response are 200 thats mean OK!!

We can see that after changing this objective value, the profile is getting changed due to which we are able to visit the profile of other user without login.

Click here for more information

Disclaimer