Insecure Direct Object Reference IDOR ( Broken Access Control ) IDOR - PowerPoint PPT Presentation

Feb 02, 2024 •393 likes •517 views

Insecure Direct Object Reference IDOR ( Broken Access Control ) IDOR ( Broken Access Control ) ~# whoami Eric Biako Bsc. IT, CEH v9 Information security officer @ E-connecta Moderator @ https://legalhackmen.com IDOR ( Broken Access Control )

Insecure Direct Object Reference IDOR ( Broken Access Control )
IDOR ( Broken Access Control ) ~# whoami • Eric Biako Bsc. IT, CEH v9 Information security officer @ E-connecta Moderator @ https://legalhackmen.com
IDOR ( Broken Access Control ) IDOR occurs when a user supplied input is unvalidated and direct access to the object requested is provided.
IDOR ( Broken Access Control )
IDOR ( Broken Access Control ) This dwells on session management where the user has to be authenticated and/or authorized.
IDOR ( Broken Access Control )
impact…….. • unauthorized information disclosure • modification or destruction of data. • performing a function outside of the limits of the user.
IDOR ( Broken Access Control ) Prevent it….. Enforce access control policies such that users cannot act outside of their intended permissions
IDOR ( Broken Access Control ) Prevent it….. Use hash function and use hashed values instead of normal numbers or strings.
IDOR ( Broken Access Control ) Prevent it….. www.example.com/user.php?id= 12 www.example.com/user.php?id= ea3eda3d3w229 3
IDOR ( Broken Access Control ) DEMO BWAPP(www.itsecgames.com ) https://sourceforge.net/projects/bwapp/files/bWAPP/ OWASP WEBGOAT : https://github.com/WebGoat/WebGoat
IDOR ( Broken Access Control ) https://www.bugcrowd.com/how-to-find-idor-insecure-direct-object- • reference-vulnerabilities-for-large-bounty-rewards/ https://www.gracefulsecurity.com/idor-insecure-direct-object-reference/ • https://codeburst.io/hunting-insecure-direct-object-reference- • vulnerabilities-for-fun-and-profit-part-1-f338c6a52782 https://medium.com/@woj_ciech/explaining-idor-in-almost-real-life- • scenario-in-bug-bounty-program-c214008f8378 https://blog.detectify.com/2016/05/25/owasp-top-10-insecure-direct- • object-reference-4/

Download Presentation

Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

A4: Insecure Direct Object References A4 Insecure Direct Object References General

A4: Insecure Direct Object References A4 Insecure Direct Object References General problem: Unrestricted Access A4: Data not properly protected A7: Functions not properly protected Examples Presentation-layer access control

506 views • 27 slides

Hacking Web Sites Insecure Direct Object Reference Emmanuel Benoist Fall Term 2020/2021 Berner

Hacking Web Sites Insecure Direct Object Reference Emmanuel Benoist Fall Term 2020/2021 Berner Fachhochschule | Haute ecole sp ecialis ee bernoise | Berne University of Applied Sciences 1 Table of Contents Introduction

890 views • 35 slides

Access Control Access Control 1 Access Control Access control : ensures that all direct

Access Control Access Control 1 Access Control Access control : ensures that all direct accesses to object are authorized a scheme for mapping users to allowed actions Protection objects : system resources for which protection is

576 views • 21 slides

Ninja Scaning by Fyodor CanSecWest 2009 March 20, 3:50 PM

Insecure.Org Insecure.Org Ninja Scaning by Fyodor CanSecWest 2009 March 20, 3:50 PM http://insecure.org/presentations/CSW09/ Insecure.Org Insecure.Org Ncat http://nmap.org/ncat/ Insecure.Org Insecure.Org Modern Networking Features

689 views • 21 slides

Authentication in Distributed Systems Austen Barker Access Control Operation Object principal

Authentication in Distributed Systems Austen Barker Access Control Operation Object principal Reference monitor Challenges of a distributed system Autonomy : Path from principal to an object may be long and convoluted. Size : Usually much

304 views • 29 slides

Broken Authentication: What it means, and what you can do hassan.abudu@owasp.org OWASP Top 10

Broken Authentication: What it means, and what you can do hassan.abudu@owasp.org OWASP Top 10 Vulnerabilities - 2017 Rank Name 1 Injection 2 Broken Authentication 3 Sensitive Data Exposure 4 XML External Entities 5 Broken Access

207 views • 6 slides

Ajax Reading & Reference Reference XMLHttpRequest object

Internet Programming Session 11 Ajax/Servlets Session 11 Ajax Reading & Reference Reference XMLHttpRequest object en.wikipedia.org/wiki/Xmlhttprequest Specification developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest

478 views • 14 slides

E ast T e nne sse e T e c hnology Cor r idor F ie ld Chapte r (E T T C F C, SAME )

Soc ie ty of Ame r ic an Militar y E ngine e r s E ast T e nne sse e T e c hnology Cor r idor F ie ld Chapte r (E T T C F C, SAME ) In coordination with the Nashville Post, SAME 1 SAME Mission To provide education and support

653 views • 11 slides

Direct Access Electricity Administration/Finance Issues Cte May 16, 2013 Approved Direct Access

Direct Access Electricity Administration/Finance Issues Cte May 16, 2013 Approved Direct Access (DA) Service Providers Contracts in place for two 1. major DA Service Providers They will both offer pricing, 2. with the award going to the

186 views • 14 slides

CBM and Bill Presentation Quick Reference How do I get access to CBM? How do I get access to

CBM and Bill Presentation Quick Reference How do I get access to CBM? How do I get access to Bill Presentation? You need to work with your Access Request If you have any kind of Finance access Coordinator to get access to CBM. (besides buying

306 views • 4 slides

Scripting and Extending Nmap and Wireshark with Lua by Gerald Combs & Gordon Fyodor

Insecure.Org Insecure.Org Scripting and Extending Nmap and Wireshark with Lua by Gerald Combs & Gordon Fyodor Lyon Sharkfest 2010 June 16, 1:15 PM http://insecure.org/presentations/Sharkfest10/ Insecure.Org Insecure.Org Nmap

278 views • 16 slides

NJ Direct 10/Aetna Freedom 10 v. Horizon Direct Access 10 Brown & Brown Benefit Advisors 1

NJ Direct 10/Aetna Freedom 10 v. Horizon Direct Access 10 Brown & Brown Benefit Advisors 1 Montgomery Township Board of Education SEHBP NJ Direct 10/Aetna Freedom 10 vs Horizon Direct Access 10 NJ Direct 10/Aetna Freedom 10 Horizon

471 views • 36 slides

L ongme adow Par kway F ox Rive r Br idge Cor r idor July 7, 2015 L ongme adow Par

L ongme adow Par kway F ox Rive r Br idge Cor r idor July 7, 2015 L ongme adow Par kway Br idge Cor r idor 5.6 mile s fr om Huntle y Road to IL 62 Unique munic ipal/ c ounty/ state / fe de r al par tne r ship L

476 views • 19 slides

D2: Access Control #2: Access cess Contr trol ol Similar to OWASP Top 10 Insufficient

D2: Access Control #2: Access cess Contr trol ol Similar to OWASP Top 10 Insufficient access control and authentication checks Insecure access control methods Private, internal functions and data are accessible through a

547 views • 11 slides

An incremental approach RCGC Defined Each object has associated count of references to it

An incremental approach RCGC Defined Each object has associated count of references to it Objects reference count When reference to object created Pointer copied from one place to another assignment RC of pointee is

313 views • 19 slides

Copying Objects: Reference Copy Copies: Reference vs. Shallow vs. Deep Reference Copy c1 := c2

Copying Objects: Reference Copy Copies: Reference vs. Shallow vs. Deep Reference Copy c1 := c2 Copy the address stored in variable c2 and store it in c1 . Writing Complete Postconditions Both c1 and c2 point to the same object.

115 views • 10 slides

http://xkcd.com/932/ Homework 2 Review CS 166: Information Security Authorization: Part 1 Prof.

http://xkcd.com/932/ Homework 2 Review CS 166: Information Security Authorization: Part 1 Prof. Tom Austin San Jos State University Authentication vs Authorization Authentication Are you who you say you are? Restrictions on who

1.14k views • 79 slides

NETCONF Access Control draft-bierman-netconf-access-control-01 IETF 77, March 2010 Andy Bierman

NETCONF Access Control draft-bierman-netconf-access-control-01 IETF 77, March 2010 Andy Bierman andyb@iwl.com Agenda Why does NETCONF need a standard access control model (ACM)? What are the functional requirements for a standard ACM

842 views • 26 slides

1 General Access Control General Access Control Control of access to memory relatively easy:

Role of Access Control Before closing back doors we need to close front doors Access control: determines access to files & processes in OS Fall 2008 We will return to these themes throughout the course Fall 2008 CS

512 views • 6 slides

Access Control and Processes Por$ons courtesy Ellen Liu CSE/ISE

CSE/ISE 311: Systems Administra5on Access Control and Processes Por$ons courtesy Ellen Liu CSE/ISE 311: Systems Administra5on Outline Access control

385 views • 20 slides

Risk-Aware Role-Based Access Control Liang Chen Jason Crampton Information Security Group, Royal

Risk-Aware Role-Based Access Control Liang Chen Jason Crampton Information Security Group, Royal Holloway, University of London 7th International Workshop on Security and Trust Management Risk-Aware RBAC Introduction Introduction

604 views • 16 slides

Relational Access Control with Bivalent Permissions in a Social Web/ Collaboration Architecture

Relational Access Control with Bivalent Permissions in a Social Web/ Collaboration Architecture Todd Davies and Mike D. Mintz Symbolic Systems Program Stanford University http://deme.stanford.edu This paper is about access control. But we

267 views • 26 slides

Security and Authorization Chapter 21 Database Management Systems, 3ed, R. Ramakrishnan and J.

Security and Authorization Chapter 21 Database Management Systems, 3ed, R. Ramakrishnan and J. Gehrke 1 Introduction to DB Security Secrecy: Users should not be able to see things they are not supposed to. E.g., A student cant see

289 views • 8 slides

Access Control Chester Rebeiro Indian Institute of Technology Madras Access Control (the tao of

Access Control Chester Rebeiro Indian Institute of Technology Madras Access Control (the tao of achieving confidentiality and integrity) Who can access What Objects : Subjects : Files/ Programs/ Sockets/ User/ process/ application

1.31k views • 50 slides