IDOR Vulnerability Testing

Resultado esperado:

Starting IDOR vulnerability assessment...

Test 1: Increment/Decrement ID
Original: GET /api/profile?id=1001 → Returns user_1001 data
Modified: GET /api/profile?id=1000 → Returns user_1000 data

VULNERABILITY CONFIRMED: Horizontal privilege escalation detected. Application returns other users' profile data without verifying ownership.

Affected Endpoints:
- /api/profile?id={id}
- /api/user/{id}

Recommended Fix: Implement server-side ownership check comparing request.user.id with requested profile id before returning data.

Resultado esperado:

Burp Suite Intruder Configuration:

1. Send GET /api/invoice/123 to Intruder (Ctrl+I)
2. Set payload position on '123' in the URL
3. Attack Type: Sniper
4. Payloads:
- Type: Numbers
- From: 1
- To: 500
- Step: 1
5. Start Attack

Analysis Guide:
- Filter for 200 OK status codes
- Check response content for different invoice data
- Verify if any 200 responses belong to other users
- Look for 403/404 patterns to identify valid vs invalid IDs

Risk: If 200 responses return other users' invoice data, this is a critical IDOR vulnerability exposing sensitive financial information.

Resultado esperado:

REMEDIATION: Address Update IDOR

Current Vulnerable Code:
def update_address(request, address_id):
address = Address.objects.get(id=address_id)
address.update(request.data) # No ownership check!

Secure Implementation:

Option 1 - Ownership Validation:
```python
def update_address(request, address_id):
address = get_object_or_404(Address, id=address_id)
if address.user_id != request.user.id:
return HttpResponseForbidden('Unauthorized')
address.update(request.data)
return JsonResponse({'status': 'success'})
```

Option 2 - Indirect Reference Pattern:
```python
def update_address(request):
# Always filter by authenticated user
address = get_object_or_404(Address, user=request.user)
address.update(request.data)
return JsonResponse({'status': 'success'})
```

Recommendation: Use Option 2 (indirect references) as it prevents IDOR by design rather than relying on validation checks.