OK, so in the last lecture, we talked about Ximo external energy injection and this lecture, we're
going to talk about broken access control, a specifically insecure direct object, references also
known as Aidala.
Now, before we get into it, I just want to show you guys how prevalent this bug is and what potential
payouts can be.
You'll see five figure payouts in some cases.
Look at this one.
New emails from any inbox.
Ten thousand call out either to add secondary users.
And this paper outside you click that you're taking here, you can see this bug.
This researcher, this researcher born to hack, was awarded ten thousand five hundred dollars.
And the bug description is right here.
And essentially what happened is business account users.
We're able to assign secondary users from other accounts.
And then once that happened, the secondary user was able to get unauthorized access to functions that
it shouldn't have had access to.
So now the details of this bug aren't disclosed here.
Obviously, this is a high security bug.
But but you'll see stuff like this all the time.
And so let me just break down my door just so you can understand what it is.
So we're talking about an insecure, direct object reference.
And, you know, the impact obviously can be huge.
The basic nature of the vulnerability is it's a broken access control because, you know, we're able
to access someone else's account or we're able to do something we shouldn't be able to do in someone
else's account.
And one of the ways to test for this is to, you know, increment a numeric value to try to access a
resource directly so we can try to guess the identifier through an enumeration attack.
And this is actually know surprisingly difficult for Web application to to fix or for developers to
fix or to anticipate.
You know, Web developers need to ensure that the session is properly managed.
They need to make sure that, you know, access control checks at the object level gets very granular
if you really want to take these bugs to the death.
That's the way to do it.
And ideally, developers should be performing static application, security testing and doing line of
code analysis before the product is pushed to production.
Why?
Because it's more expensive to address phones after they've been already pushed to production.
So let's jump into this class of bugs here.
So what we're going to do is we're going to create an account.
We're going to see if we can access something from someone else's account.
Right.
So if I go to not get a customer, I can create an account.
Real quick, let's see.
Security question.
Mother's maiden name.
Yeah, my mother's name is Default Register.
All right, so I registered should be able to log in.
Sweet.
So I'm in and we have berp ready to go into Stepaside first, but I want to do is just kind of observe
the general behavior of this page.
So let's take Interceptor off.
And filter all the traffic through berp.
So if I look at my basket, there's nothing here, right?
Let's just add apple juice.
You can see apple juice was added.
Apple promised, I don't know what that is and banana is.
And I do the.
The only one left with this thing, so let's get this best use.
All right, so we look at our basket.
We've got four items now, if we go back to berp, we go to the history, you can see what we did.
And if you look at this, you'll notice it says Reste Baskette six.
Right.
So it looks like we're making a get request to this end point and this number as an identifier of some
kind, possibly identifying us, because if you look at the response, you can see.
The items we added to our basket, right?
Apple juice, banana juice, apple pomace and the best use, right, so obviously as a researcher,
the first thing you should try to do is test for it.
Or when you see a number like this that you can increment, it may not always be in the target request.
It might be in a cookie.
It might be in another header field.
But we want to play with this to see if we can access something else that we shouldn't have access to.
So I'm going to do a controller control shift are to go to a repeater and control space just to rescind
the request.
And I got the same results.
So if we change this to like a one which typically associated with an admin account, the first record
is usually admin.
And you can look at our sequel injection talk to get more details about that.
If I press control space, look at that.
I got something different.
A fruit juice, orange juice.
Apple juice.
It's like I'm looking at somebody else's record, right?
So we need to test this.
We need to see if that's actually what's happening.
So we're going to go to proxy.
Int. Look back over to the webapp.
And let's go back here.
All right, so we know what our basket looks like, right?
Right, apple juice, banana juice, apple pie and the best juice.
But we're going to do is we're going to flip back over.
Tiberg.
Intercept is on and try to add something to our basket.
All right, changes to a one forward forward and you can see when I flip over, I'm now looking at someone
else's basket, right?
So the webapp still thinks I have six items in my basket.
But clearly, this is not my basket.
We didn't have these things.
So there you have it.
And this would be a critical finding, right?
Because I'm able to gain access to someone else's shopping basket.
You know, is it possible then that I can check out as that person, maybe I can include items into
their basket that they didn't initially put there?
Right.
Or maybe I can access other information from users based on this insecure direct object reference vulnerability.
Because where there is one, there's probably more.
Right.
So that would require more careful analysis, you know, going through the HTP history, looking at
these requests and trying to see if there's other ways, other things you can do by looking at some
of these fields, these other fields.
You can actually see them over here and look at the request and you can see the letters that were sent.
Right.
That's all we have in this lecture in the next one, we're going to take you to Chicago's configurations.
So I'll see you guys in the next lecture by.