Packt+ | Advance your knowledge in tech

You're reading from Hands-On Application Penetration Testing with Burp Suite Use Burp Suite and its features to inspect, detect, and exploit security vulnerabilities in your web applications

Product type Paperback

Published in Feb 2019

Publisher Packt

ISBN-13 9781788994064

Length 366 pages

Edition 1st Edition

Tools

Burp Suite

Concepts

Penetration Testing

Authors (3):

Carlos A. Lozano

Dhruv Shah

Ahemed Walikar

View More author details

Table of Contents (14) Chapters

Preface

1. Configuring Burp Suite FREE CHAPTER

2. Configuring the Client and Setting Up Mobile Devices

3. Executing an Application Penetration Test

4. Exploring the Stages of an Application Penetration Test

5. Preparing for an Application Penetration Test

6. Identifying Vulnerabilities Using Burp Suite

7. Detecting Vulnerabilities Using Burp Suite

8. Exploiting Vulnerabilities Using Burp Suite - Part 1

9. Exploiting Vulnerabilities Using Burp Suite - Part 2

10. Writing Burp Suite Extensions

11. Breaking the Authentication for a Large Online Retailer

12. Exploiting and Exfiltrating Data from a Large Shipping Corporation

13. Other Books You May Enjoy

Leave a review - let other readers know what you think

Detecting Insecure Direct Object References

An Insecure Direct Object Reference (IDOR) vulnerability appears when a parameter gains access to a certain resource. By modifying this parameter, it is possible to access other resources that are not authorized for this user. Usually the affected parameters are used as control for the application's flow, for example, the named id, uid, r, url, ur, and so on.

These kinds of vulnerabilities could be detected using the Target tool in Burp Suite. Similar to the CSRF detection, the more URLs you detect, the more possibilities there are to find vulnerabilities:

To add a target to the scope, go to Burp Suite, and using the secondary button of the mouse, click on Add to the scope option.
Then go to the Target tool, and click on the Scope tab. Here you will see listed all the URLs, domains, and sections added to the scope. If you want you can limit the Burp Suite's history just to log requests in the scope, but I do not recommend that, because sometimes it...