Hi everyone,
I am Aditya Shende (Kong) from India. Bounty Hunter , Biker and Researcher.
This is my 3rd article , If you found any spell error. Let it be…..
What is IDOR ?
Entity names are used to identify application-controlled resources that are supplied in URLs or request parameters in a Direct Object Reference web application design method.
Lets get started…..
As normal user I tested all function including update, delete, download, make post public and private etc . Found many bugs but this one is interesting as I think . Viewing profile function was my first shot and POST parameters are second . Endpoint : POST /Profile . See the screenshot below
So basically it was disclosing enough information , I tried for my self . Now playing with username parameter was good shot where I put another username number got his information including home address , role, number , access level etc.
On profile section reset password function was there so evil mind comes up
If I know _id of any user then I can reset his/her password. I tried the same what I thought and it was working fine , So how I did it. POST request containing _id and password , I replace my id to another user encrypted id and forwarded request
After passing this request , Response was 200 OK and all we know JSON context params have default responses like : true , verified , error, success etc. Mine one came up with “true”
So I tried to access that user account with user username and password which I set and it was working and leads to ATO of admin. I have multiple privileges that normal user cant access
And again I got multiple different functions to test . On that site I found more than 20 vulnerabilities.
Thanks for reading , Jai hind
