-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating
Zed Attack Proxy Cookbook
By :
Insecure Direct Object References (IDOR) occur when an application references objects in an insecure way that allows user-supplied input to manipulate and directly access those objects. Attackers that exploit this vulnerability are able to bypass authorization and directly access resources on the server (i.e, database records or files).
To start, ensure that ZAP is started and use the PortSwigger Academy lab, Insecure direct object references.
Here, we’ll attack a live chat feature of the application, which will allow us to view other users’ messages to the fictitious web app support. Let’s look at the steps:
You will notice that this downloads a numbered text file. When you look at the response in ZAP’s Manual...