Everybody welcome to the next video so we're gonna be talking about something called a door or insecure
Direct Object reference.
Now what about this particular vulnerability is it can be prevented pretty easily but in some cases
it's overlooked.
Now what happens here is if we look at this this simple web app we're trying to order tickets right.
So it's it's ten dollars a ticket.
If we buy we want five of them we click order we purchase five tickets they cost fifty dollars at ten
dollars per pop.
All right.
So nothing weird here but if we if we do a quick look and we look at the source now you're going to
notice something you're going to see.
We have a hidden value here called cost.
Now that value is 10.
So what's what's happening with indirect or insecure direct object references is when we're doing something
like this.
Let me actually show you the source code really quickly so you can see what I'm looking.
What I'm referring to.
So here's the BHP code behind that same website.
Right.
So we have a form which is posting to this to itself and with the amount per which is the name amount
which is what we can see here.
We can see that fine.
Then we have our hidden one which is cost of 10 which again we can see here.
Then we have our Submit button which is just the summit button right here.
Right.
So when we pee pee wee we look and see if we get the order right so was order present if it was give
ourselves a few lines and then we calculate the total.
So you can see here we're referencing the total.
We're grabbing or regret or referencing the amount the user wants to buy and the cost of it.
Now what's important here is you might have seen this as a common theme is we're trusting the input
from a user without sanitizing it.
This is a problem every single time you have to sanitize this.
And in most cases a cost of something should never ever be sent from the client side back to the server.
The server should know what the cost is.
So you keep it in a database or something like that because right here is if we change that cost of
ten to one or zero then what it does this calculation says the amount that we want to buy times whatever
we want is then we echo what we purchased.
And then the total amount per ticket.
Now if you don't see it here.
I'll go ahead and I'll show you quickly.
So if we do inspect element right.
So if we look at our form we can see here again this is the dom.
So we see our value of 10 so let's just roll back if we bought 100 tickets it would cost us a thousand
dollars.
But if we cost if we bought 100 tickets and we changed our cost hidden cost value to a dollar bought
100 hundred tickets now we can see we bought 100 tickets for one hundred dollars at a cost of one dollar
instead.
So what's referring to the object and cost and multiplying that with the amount that's past about the
user so the amount is fine.
We're passing the amount by the user.
You should still sanitize it make sure it's a digit.
Make sure there's nothing else stupid coming into play here but what's important here is the value here
of cost so if we change that to let's say zero this time we bought a shit ton of tickets.
It costs us nothing.
So this is how it can be used in this type of attack can be used.
And you might have also noticed when we looked at the code on what's being present here so we could
see we're buying X amount of tickets.
Right.
So what happens if we do this.
What happens if we do that I see vulnerable to cross site scripting just based on what we were saying
we weren't sanitizing any input.
What we see here now numeric value is and it was accounted for.
So now we've got path to disclosure which is another type of vulnerability.
So you're able to show the full path of the HP file and what line the issue was on.
But the biggest part of this path so now we know where the Web root is so that makes sense when we looked
back at the sequel injection tutorial you'd notice that it was try.
It was asking us where the path was.
So in this case it's far doubly WW slash HMO now if we didn't know that and we had other issues where
we could find out where the path is or give it something stupid that it's not expecting such as that
you're giving it a string where it's expecting something that's obviously a digit then you might be
able to pull something like this out and then you have the full path and then you can use your school
map with that known path if it's a custom location to then get access to your shell so you can see how
a lot of stuff combines together when you're looking at something when you're trying to attack a machine
so I'm going to go ahead and post the code for this or I'm actually gonna link the text version of this
to the DOT to 60 which is right here so you can go ahead and copy this into a file in your web root
or your DV w DV W.A. is and you can call it you know I tore it up and make sure it's a dot P. HP and
then you can go ahead and load that up and you should get the same same results that you can play with.
So go ahead and play around this see what other vulnerabilities you can make out of this.