3 ms·

I wonder if he's come up with some automated tooling to find them, seems like this might be the best way to monetize if so.

tyingq 8y ago
I found this, describing his specialty: "Lopez specializes in the identification of Insecure Direct Object Reference flaws also known as IDOR vulnerabilities." Then this, explaining IDOR: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.md https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... It certainly sounds like the sort of thing you could automate to a pretty big scale.
- zulln 8y ago
  Do you have any suggestions on how? I do not doubt it can be automated, but it is one of few vulnerability types I do not have an intuitively understanding on how it should be done. It seems hard to automatically understanding the difference with IDOR-vulnerability in the HR-system (from your link), salary.php?employee=EMP-00000 where you can change the ID for another employee and article.php?id=123 in a newspaper site.
  - dooglius 8y ago
    Would it have to understand the difference? You could do pretty well with a crawler that detects such fields (by checking a simple increment, say) that then spits out URL/field combinations. Then you just need to scan through those and follow up on the ones that look like security holes.
  - tyingq 8y ago
    You could focus on links that aren't in Google's cache, or links that match some numerical pattern in a set cookie, etc. Cookies are probably a whole thing on their own in this space too.
- nickpsecurity 8y ago
  I don't do web apps. So, all I could do is DuckDuckGo for some terms that might get results. Found claim about using automated, open-source scanners to find IDOR and a lot of other stuff here: http://www.zemris.fer.hr/~sgros/publications/diploma_thesis/suhina_vanja_seminar.pdf http://www.zemris.fer.hr/~sgros/publications/diploma_thesis/... They do note that IDOR poses some difficulties with it needing heuristics that might have high, false positives. The tools are in the references section toward the bottom. Try them out.

tyingq 8y ago

I found this, describing his specialty: "Lopez specializes in the identification of Insecure Direct Object Reference flaws also known as IDOR vulnerabilities." Then this, explaining IDOR: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.md https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... It certainly sounds like the sort of thing you could automate to a pretty big scale.

zulln 8y ago
Do you have any suggestions on how? I do not doubt it can be automated, but it is one of few vulnerability types I do not have an intuitively understanding on how it should be done. It seems hard to automatically understanding the difference with IDOR-vulnerability in the HR-system (from your link), salary.php?employee=EMP-00000 where you can change the ID for another employee and article.php?id=123 in a newspaper site.
- dooglius 8y ago
  Would it have to understand the difference? You could do pretty well with a crawler that detects such fields (by checking a simple increment, say) that then spits out URL/field combinations. Then you just need to scan through those and follow up on the ones that look like security holes.
- tyingq 8y ago
  You could focus on links that aren't in Google's cache, or links that match some numerical pattern in a set cookie, etc. Cookies are probably a whole thing on their own in this space too.
nickpsecurity 8y ago
I don't do web apps. So, all I could do is DuckDuckGo for some terms that might get results. Found claim about using automated, open-source scanners to find IDOR and a lot of other stuff here: http://www.zemris.fer.hr/~sgros/publications/diploma_thesis/suhina_vanja_seminar.pdf http://www.zemris.fer.hr/~sgros/publications/diploma_thesis/... They do note that IDOR poses some difficulties with it needing heuristics that might have high, false positives. The tools are in the references section toward the bottom. Try them out.