What happens if I change this URI… oooooh
summary
Broken Access Control is now OWASP Top 10 #1 and simple IDORs let attackers enumerate sequential IDs to view or change others’ data; real breaches include a cabin-booking site leaking names, addresses and dates and Parler having >99% of posts scraped. Testing demonstrates that plus one testing often finds issues, and tools used—Burp Suite with the Authorize extension and a custom Fiddler script that harvests tokens—replicate requests across users and expose gaps; an automated OpenAPI-driven test harness scales these checks where pen tests miss them.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 3:38Broken access control in OWASP Top 10
- 13:36IDOR vulnerabilities and risks
- 26:00Authorization flaws persist
- 35:53Testing and fixing access control
- 51:13Advanced IDOR cases
related talks
49mWhat happens if I change this URI… oooooh
35mHow to Break API's
30mAPI Security - Divide & Conquer
46mAPI Security – Divide & Conquer
53mOAuth2/OIDC security weaknesses and pitfalls
30mBOLA, IDOR, MA, BFLA. Welcome to the OWASP API Top 10!
47mTop X OAuth 2 Hacks
01h 29mAPI Vulnerabilities and What to Do About Them