v09025g40000cf39fmjc77u5guvou4gg
Apr 23, 2026 19:45
· 1:54
· English
· Whisper Turbo
· 2 스피커
이 증명서는 오늘 만료됩니다.
영구 저장소 업그레이드 →
보이는 것만
0:00
S…
Speaker 1 (v09025g40000cf39fmjc77u5guvou4gg)
This is Eidor in 100 seconds. An Eidor or an insecure direct object reference is an access control vulnerability caused by a user-controlled identifier pointing to an object.
0:14
S…
Speaker 1 (v09025g40000cf39fmjc77u5guvou4gg)
Consider the example where a bank allows users to check their payments. Every payment has an incremental ID and can be viewed at slash payment slash ID. Let's say that I have a payment with ID 5697. Then I might wonder, well, what is the payment with ID 5698? If there's no proper access controls in place and I can access someone else's payment, then I found an IDOR.
0:40
S…
Speaker 1 (v09025g40000cf39fmjc77u5guvou4gg)
The impact of an IDOR can range from being able to leak sensitive data to being able to perform actions as another user. It's a vulnerability that's hard to detect by defenders and easy to exploit by hackers.
0:54
S…
Speaker 1 (v09025g40000cf39fmjc77u5guvou4gg)
Oftentimes people think that just using UUIDs is a fix for an IDOR. However, UUIDs do not provide any security mechanisms and should always be accompanied by the right access controls. When testing for IDOR vulnerabilities, try to find calls that require your ID and replace that ID with another one. If the call still works then you may have found an IDOR.
1:20
S…
Speaker 1 (v09025g40000cf39fmjc77u5guvou4gg)
IDORs can get more complex however. See if globbing works, if there is another version of the API, see if you can replace the request's content type, see if you can change the ID to an array, try to change the extension. All of these tricks may allow you to find IDORs that others may have missed. This has been IDOR in 100 seconds. For more information, check the resources in the description. Which vulnerability would you like to see us cover next?
1:48
S…
Speaker 2 (v09025g40000cf39fmjc77u5guvou4gg)
Let us know down in the comments.
이 기록은 AI (자동 음성 인식)에 의해 생성되었습니다. 오류가 있을 수 있습니다 - 중요한 사용을 위해 원본 오디오와 확인하십시오. AI 정책
요약
요약 을 클릭하여 이 녹음의 AI 요약을 생성합니다.
요약...
이 녹음에 대해 AI에게 물어보기
이 녹음에 대해 질문하십시오 — AI는 관련 섹션을 찾아 답변합니다.