I Found An IDOR Flaw where users' attached pictures and documents were leaked.

Thank you for 2K Followers, keep showing love :) Hi, Ajak Amico’s welcome back to another blog. I will explain how I found an IDOR vulnerability in a particular API request which led to see other user’s attached documents and pictures. So before starting, if you haven’t subscribed to our channel, do subscribe, guys.

Follow our Youtube Channel: @ajakcybersecurity (360 Videos)

Follow on Instagram:AjakCybersecurity

So the first step of my recon was to do subdomain enumeration, and to do this, I used the below-mentioned online tool, just quick and effective https://subdomainfinder.c99.nl/ and used Bulk URL extension to open and see live domains. on the other side, I just hit my Kali Linux and used waybackurls to fetch archive URL’s

Hence, this is a site where users will create tickets and send complaints regarding phishing and banking queries. The website had different features such as creating posts, login page, register page, attaching images and documents to the post and so much stuff. so I wanted to play it now.

The website had Cloudflare WAF, when you try to insert any malicious queries in any API, your request will be blocked, It was a good site to play with IDOR vulnerability, but my request kept on blocking, and the important thing about exploiting here is, if community manager finds your response is suspicious your whole account gets banned, for me 2 accounts got banned for doing brute force, and inserting SQLI payloads when submitting tickets.

Ok coming back, I created a support ticket, and you have options like attaching images and documents, so immediately I attached an image, and, clicked on the preview ticket, and this is how it looked

before posting it, I clicked on the copy image address and opened it in a new tab, and my request looked like this

I tried to change the ‘user id’ nothing worked, but once I changed my ‘attachmentid’ I got a new picture in my browser, that took with some bank details and address. I was surprised and captured the request and response in burp, this is what it looked like.

No CSRF_token💀 and now I was able to download many images and documents of other users as mentioned in the below picture. for security reasons, I have blurred all sensitive information and transaction amounts

Ok, now the toughest job is scraping each and every image and PDF’s manually, as I already, said, your account will be banned by community manager, if any malicious or brute forcing takes place, so I opened chatGPT, and told to give me 50 requests just by changing the attachmentid one-by-one, like below

Now I opened bulk URL extension and just pasted all the URLs which ChatGPT gave, like the mentioned screenshot below.

This opened me all 50 requests in 50 new tabs, this took a little bit of time, but worth going through it, as I got even more sensitive info from the user-attached pics and documents. hope you enjoyed it, I will see you in the next blog :)

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Hope you would have learned some information from this blog if so, kindly press that follow button for further updates. Best wishes from Ajak Cybersecurity.❤️

“கற்றவை பற்றவை🔥”

Learn Everyday, Happy Hacking 😁🙌

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Follow our Youtube Channel: @ajakcybersecurity

Follow on Instagram: @ajakcybersecurity