Hacker News Reader

Comment by dooglius | Hacker News Reader

I wonder if he's come up with some automated tooling to find them, seems like this might be the best way to monetize if so.

View on HN

I found this, describing his specialty:

"Lopez specializes in the identification of Insecure Direct Object Reference flaws also known as IDOR vulnerabilities."

Then this, explaining IDOR: https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...

It certainly sounds like the sort of thing you could automate to a pretty big scale.

I don't do web apps. So, all I could do is DuckDuckGo for some terms that might get results. Found claim about using automated, open-source scanners to find IDOR and a lot of other stuff here:

http://www.zemris.fer.hr/~sgros/publications/diploma_thesis/...

They do note that IDOR poses some difficulties with it needing heuristics that might have high, false positives. The tools are in the references section toward the bottom. Try them out.

Do you have any suggestions on how? I do not doubt it can be automated, but it is one of few vulnerability types I do not have an intuitively understanding on how it should be done.

It seems hard to automatically understanding the difference with IDOR-vulnerability in the HR-system (from your link), salary.php?employee=EMP-00000 where you can change the ID for another employee and article.php?id=123 in a newspaper site.

Would it have to understand the difference? You could do pretty well with a crawler that detects such fields (by checking a simple increment, say) that then spits out URL/field combinations. Then you just need to scan through those and follow up on the ones that look like security holes.

You could focus on links that aren't in Google's cache, or links that match some numerical pattern in a set cookie, etc. Cookies are probably a whole thing on their own in this space too.

Reply on news.ycombinator.com