HACKING JULY DAY 16: VULN-BANK EXPLOITATION #3

Today's Challenge

I will exploit an IDOR/BOLA vulnerability where I will be able to see the transactions of other users.

The vulnerabilities

Insecure direct object reference
Broken Object level authorization

Insecure direct object reference
Broken Object level authorization

The tool

Burp suite

Burp suite

I logged in to a customer account using SQLi as in the previous write-up.

The Exploitation

After logging in with the customer account, I headed to Burp Suite to see whether I can find something interesting in the HTTP traffic.

I found one which had an endpoint of my account number.

I tried to use a sniper attack but that would require either of the two things, either time or more OSINT to make the attack effective.

Here is a result of what the sniper attack turned out which showed that there is no verification of the user before sourcing out crucial information.

As you can see, the status code is 200 OK.

For learning purpose and to save time, I remembered that I know the admin's account number.

Immediately, I sent the request to repeater and replaced my account number with the admin's account number. As expected, the transactions of the admin were sourced out and brought back to me as the response.

The concept would be the same if I used sqlmap to get the account numbers and use them in a sniper attack.

I really appreciate your time. Consider checking my previous write-up here.