-
Book Overview & Buying
-
Table Of Contents
Hands-On Application Penetration Testing with Burp Suite
By :
IDOR is a vulnerability that allows a malicious user to access files, databases, or sensitive files in the server that hosts the application.
To identify vulnerable applications to IDOR, it is necessary to test each variable that manages paths into the application. Let's look at an example of how to exploit this kind of vulnerability.
In the following screenshot, you have a vulnerable application and you have intercepted the next request:

We have their parameters in this request; login, action, and secret. The vulnerable parameter here is login. The secret variable is the data assigned by the user during their registration; the vulnerability that exists is that if the malicious user modifies the login parameter, the application changes the secret value for the user specified without validation. So, we have created another user called vendetta2, to try to modify the secret value pertaining to this...
Change the font size
Change margin width
Change background colour