Insecure Direct Object References

🎯 Objective

Identify and exploit an Insecure Direct Object Reference (IDOR) that exposes other users’ chat logs.

🧭 Scope / Setup

• Tooling: Burp Suite (Scope, Proxy, Repeater, Target sitemap)
• Target Feature: Live Chat + Download chat logs
• Authentication: In-scope user session

🔎 Discovery

1. Add the site to Target → Scope and crawl manually.
2. Observe Live Chat functionality and Download chat logs endpoint.
3. Intercept the chat log download request and send to Repeater.
4. Manipulate the log identifier in the URL (e.g., /chat/logs/1 → /chat/logs/2, /3, …).

Screenshots

• Crawling the app:
  
• Enumerating chat logs via parameter tampering:
  

🧪 Exploitation

• Increment/decrement the chat log ID to access other users’ logs.
• Impact observed: plaintext passwords posted by the agent to users who forgot them.

✅ Outcome

• Confirmed Broken Access Control / IDOR: direct object identifiers not protected by authorization checks.

🛡️ Mitigations

• Enforce object-level authorization on every sensitive endpoint.
• Use opaque, unguessable identifiers (e.g., UUID v4) in addition to authorization.
• Avoid placing secrets in chat transcripts; implement redaction & data minimization.

📝 Notes

• Consider adding rate limiting and anomaly detection for sequential access attempts.