What happens if I change this URI… oooooh
summary
Broken Access Control becomes OWASP Top 10 #1 and the talk shows why simple plus one test checks find common IDORs: changing a URI exposes orders, profiles or admin accounts (real incidents include event check‑in and Parler data exposure). Testing uses a web proxy, a Burp extension pattern and a live Fiddler script demo against OWASP Juice Shop that reliably reproduces view/edit flaws. Fixes shown are an automated endpoint matrix driven from OpenAPI and per‑endpoint authorization attributes; the demos work and produce actionable test results.
AI-written summary · about
chapters (13)
- 0:00Welcome
- 1:52Broken access control
- 3:38Understanding IDOR and insecure direct object references
- 8:59Authorization flaws consequences
- 13:16Authorization systems degrade
- 24:32Why authorization testing hard
- 29:13Authorization testing mistakes
- 32:26Security training lack
- 35:18Authorization testing tools
- 42:48Fiddler script demo
- 43:11Preventing authorization flaws
- 46:00Automated testing frameworks
- 48:09Fixing authorization issues
