47 lines
1.5 KiB
Bash
Executable File
47 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 10: Insecure Direct Object Reference
|
|
# Desc: Access control bypass via object IDs
|
|
# Detect: Numeric params, UUIDs, sequential IDs
|
|
# Severity: HIGH
|
|
# Tools: curl
|
|
|
|
vector_idor() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing IDOR vectors..."
|
|
|
|
local id_params=("id" "user_id" "uid" "account" "account_id" "profile" "order" "order_id" "invoice" "doc_id" "file_id" "pid" "cid" "sid" "token")
|
|
|
|
for param in "${id_params[@]}"; do
|
|
# Try sequential IDs
|
|
for id in 1 2 100 999 1000 1001; do
|
|
local test_url=""
|
|
if [[ "$target" == *\?* ]]; then
|
|
test_url="${target}&${param}=${id}"
|
|
else
|
|
test_url="${target}?${param}=${id}"
|
|
fi
|
|
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 \
|
|
-H "User-Agent: Mozilla/5.0" \
|
|
"$test_url" 2>/dev/null)
|
|
|
|
# Check for data leakage (JSON, names, emails, amounts)
|
|
if echo "\$response" | grep -qiE '"email"|"credit_card"|"ssn"|"salary"|"balance"|"secret"|"private"|"admin"'; then
|
|
print_find "Potential IDOR!" "Data accessible via $param=$id"
|
|
echo "SEVERITY: HIGH
|
|
VECTOR: Insecure Direct Object Reference (IDOR)
|
|
DETAIL: Potential IDOR via parameter '$param' with value $id on $target
|
|
EVIDENCE: Sensitive data in response: ${response:0:200}
|
|
EXPLOIT: Enumerate IDs to access other users' data" > "$REPORTS_DIR/.finding_$(date +%s)_idor.txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
done
|
|
done
|
|
|
|
return $findings
|
|
}
|