SHUBHAM PANDEY

API Information Disclosure Hello All, In this post I will provide you an overview about how to exploit Broken Object Level Authorization vulnerability. Definition: Attackers substitute the ID of their own resource in the API call with an ID of a resource belonging to another user. The lack of proper authorization checks allows attackers to access the specified resource. This attack is also known as IDOR (Insecure Direct Object Reference). OR APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface Level Access Control issue. Object level authorization checks should be considered in every function that accesses a data source using an input from the user. Lets say our vulnerable website is target[.]com Steps I did to takeover all the accounts on the test platform. Since I was already registered user on the target website. I did functionality check of the reset password feature. Reset Password Function I added my email id and user id  and...

Introduction to IDOR Hello All,  In this post I will provide you an overview about how to exploit IDOR vulnerability. What is IDOR?  IDOR:(Insecure direct object references) Due to improper validation of userid at Server side leads to Change of content. OR without any validation mechanism which allows attackers to manipulate these references to access unauthorized data OR A user can successfully request access to a webpage, a data object, or a file that they should not have access to. IDOR Attack Scenario: Case 1: Deleting other user content: 1)Victim post something on website which has a unique ID Eg: 19 Attacker: 1)Attacker creates a post which has a unique ID of 22. 2)He tries to delete his post by intercepting his deleting request. 3)In request, Change ID from 22 to 19 which results deletion of victim post. Case 2: Changing other user profile picture: Attacker: 1)Intercept the upload image request and find the Unique User ID of attacker. 2)Change the ID of attacker to vict...