Come to this video lecture we will discuss in your direct object reference insecure direct object reference
Ms ID or will never be AKA's when an attacker can access or modify some reference to an object that
a file database record I can add an extra which should actually be inaccessible to the
for example then leaving your account on a Web site with private profiles.
You might visit W.W. dot X Y Z dot com slash user equal to one two three.
However if you tried to the blue dot site dot com slash user call 1 2 4 and they're granted access.
This site would be considered vulnerable to and I our bug
identifying this type of deal ranges from easy to hard.
The most basic is similar to the example Abbo lady Id provided is a simple integer incremented as new
records are added to the site.
So testing for this would involve adding or subtracting one from the ID to check for results.
If you are using but you cannot do this by sending the request to the bop into the set of payload on
the ID and then use a numeric list with start and stop values stepping by one when running that type
of test look for contentment that changes signifying differences once has been returned.
In other words if a site isn't one never use user consistently get some type of access denied message
with the same Content-Length where things are more difficult is NSI tries to obscure references to the
object references using things like randomized identifiers such as universal unique identifiers.
In this case the idea might be a 36 character alphanumeric string which is impossible to guess.
In this case one way to work is to create to view the profiles and switch between those actions.
Testing objects.
So if we are trying to access user profiles with you Id create your profile with User A and then with
the user be trying to access that profile since you know the you ID.
If you are testing specifically cards like invoice IDs rates and etc. are identified by you it is similar
to the example Abbo trying to create those records.
As user and then access them as User B.
Since you are invalid you IDs between profiles.
If you are able to access the objects that that's an issue but not or Syria since the IDs
36 characters randomise strings this makes them on but unguessable doesn't last though.
I just find the next step is to try to find an area where that you is like.
For example on a team website can you invite user be to your team and if you do so does the server respond
with you ID when before they have accepted.
One Web sites like you ideas
in other situations check the Pacers when visiting a profile.
Sometimes site will include a GSM block for the user which also includes all of the records created
by them thereby making sense to you.
I always at this point even if we can find a league some sites will reward the wannabe.
If the information is sensitive it's really up to you to demand the impact and explain to the company
why you believe this issue should be addressed.
That's an absurd insecure that object reference when nobody.
Thanks for watching.
See you in the next class.