Welcome back.
Let's see another example of either vulnerability.
So in the previous video, we saw a simple example of tampering with one parameter in order to change
the user ID or in order to be able to see private information from a different user.
Right now, let's see what examples can we get to number of USB BVA.
So first thing or first example that I want to show you is on our ASP model data.
So let's click on that.
And here, as usual, under the OS 2013, we will have this vulnerability that says insecure, direct
object reference or in other words, it's the either vulnerability.
This is an example of a winnability that I showed you in the theory lecture.
Now let's put it to practice.
Let's go to any one of them.
So, for example, let's go to source viewer.
And in this simple page, we have a source file name to select and tells us to see the source of the
file, choose and click view file.
Note that not all files are listed.
OK, so let's choose any one of them.
For example, let's go with register dot.
Click on View for.
And it gives us the output of this before so pretty standard, but once again, remember from our teary
lecture, we must ask ourselves the question, is this or are these files that we have in this list
only files that we can read?
Well, in this box, we can't really type any other file name, however, we can intercept this request
with our suit and try to change the file.
Let's go to our Burset, turn on the intercept and let's select any file whatsoever.
Let's go pick it up and click on View File.
So we intercept the request right here and down here in these parameters, we have the peafowl parameter
that selects which page we want to, you know, since we can't really type it in right here, we're
going to type it in inside of our first read log in that BHP and let's for example, type slash at sea
slash pass w the.
Let's see if this will work, if we forward this packet, turn off the intercept, go right here.
Well, here it is.
We have the output of the ATSE W.T. folder.
And once again, that's the broken access control vulnerability.
We got the output of a file that we shouldn't be able to see.
Now, it same goes with this parameter right here in the page.
This is simply just parameter that selects which task are we currently doing?
So if we go to insecure direct object, you will see that page name is source viewer, and it probably
has some people that processes this page.
But we can also try to go and perform broken access control right here if we type Hatzis stability for
this parameter.
Well, we get another output and another broken access control vulnerability where it outputs once again
the stability file.
And it's the same with all the other examples.
So, for example, if we go to cookies right here, we can inject our ETSI pass right here in this page.
Oops, I misspelled Pasdar Boutique.
And once again, here is the output of the ABC past, that would be.
So this type of vulnerability is not that hard to perform.
Of course, it might have some filters that might protect it to some extent.
And those filters we are going to see in the next video with a different example.
However, usually once you have this vulnerability, it will most likely not have any access control
whatsoever.
Therefore, you will be able to access different things that you shouldn't be able to see.
OK, awesome.
Thank you for watching this lecture and I will see you in the next lecture.