Basic Web Hacking.
Co-Founder PT. NihonNoMise Global OverseasFour aspects an attacker goes after.
Confidentiality
Only the right people can read the data.
Integrity
Data cannot be changed by the wrong people.
Availability
The service stays up when people need it.
Authenticity
You really are who you claim to be.
C-I-A is the classic triad.
What is IDOR?
Insecure Direct Object Reference: the app exposes an id and trusts whatever id the client sends, without checking who is allowed to see it.
GET /api/profile/1023GET /api/profile/1024200 OKSame endpoint. One number.
The response is JSON: profile fields plus a password reset token. Change the id, and the server hands you another user’s token.
GET /api/profile/1023Small bug, big blast radius.
- No exploit tool needed, just change a number
- Easy to miss in code review and in tests
- One endpoint can leak every user's data
From IDOR to Account Takeover.
Account Takeover (ATO): the attacker ends up controlling an account that is not theirs, able to log in and act as that user.
- An IDOR on the change email or change password endpoint
- A password reset token tied to a guessable id
- Updating another user's account because the id is trusted
One token, four steps.
That leaked reset token is all it takes. No password needed.
"reset_token": "7bc3..."Pulled straight from the leaked user response.POST /reset-passwordSend the stolen token with a new password.200 OKThe server trusts the token and sets the password.POST /loginLog in as her. The account is yours.Live demo.
The hacking lab is ready. Let’s walk an IDOR all the way to a full account takeover, then patch it.
GET /api/profile/1/reset-password/[token]?email=victim@example.comHow we close the gap.
Authorize every request
Check that the logged-in user owns the record, on the server, every time.
Do not trust the id from the client
Scope queries to the current user, for example where user_id = auth id.
Use non-guessable ids
Prefer UUID or ULID over sequential numbers, as defense in depth.
Log and rate-limit
Watch for one account walking through many ids in a row.
Return only the fields you need
Never ship secrets like a reset token in a user response. Send what the screen needs, nothing more.