Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How an IDOR Vulnerability Led to User Profile Modification

hackerone.com | vulnerability | #bug-bounty | #web-security | #idor | #hackerone | #broken-access-control | #vulnerability-analysis

Summary

IDOR accounts for 7% of HackerOne reports. This walkthrough shows how exposed object identifiers in URL parameters, filenames, and low-entropy cookies enable unauthorized profile modification.
Published
Collected

original ↗

Related coverage

  1. How to Catch the Top OWASP 2021 Security Category - Broken Access Control - in Code Review (hackerone.com)
  2. The Rise of IDOR (hackerone.com)
  3. Access Denied (hackerone.com)
  4. Securing the Insecure Objects (labs.cognisys.group)
  5. Vulnerability Deep Dive: Gaining RCE Through ImageMagick With Frans Rosen (hackerone.com)
  6. The HackerOne Top 10 Most Impactful and Rewarded Vulnerability Types (hackerone.com)

back