so now that we have a user name and a password,
we can actually go ahead and log in and from there,
we're gonna be able to access more features,
more pages and therefore hopefully we're gonna be
able to discover more books and vulnerabilities because
as you know, the more features we have,
the bigger the scope it is and the more likely it is to be vulnerable.
So we're simply just gonna go to the homepage,
we're gonna click on log in
and I'm going to copy the user name
and we're gonna get the password from here
and we're gonna click on log in.
Now obviously you should test the value sent in the login form
but I've done that myself and I know that they're not vulnerable.
So that's why I'm not wasting your time with it.
And once we're logged in, as you can see we are getting access to our profile page.
Now this page is very zoomed in, that's why it looks a bit weird,
but as you can see it's giving us the name,
their role and some bio about this person who is a big
fan of pizza and we also have the interests in here.
So that's pretty cool and we have a new page now
it's called your profile dot PHP nothing being sent to it.
So there isn't much to be tested and none of this is clickable.
So as usual, when we don't know what to test when there is nothing to test,
we turn on the interceptor and we load the page again.
So let's look at the proxy and as you can see we have the request
to the your profile page with no interesting that have been sent to it.
So we're just gonna forward it
and another request to the same page with nothing interesting.
So again we're gonna forward this one
some requests to irrelevant websites that is outside the scope.
So we're forward in these as well.
And finally just before the page loads you can see
we actually have an interesting request with an I.
D. And
a data parameter.
So the data parameter is set to bio and the I. D. Is set to a very long I. D.
So this is very interesting.
We're going to right click and send it to the repeater for further testing as usual.
And then the repeater we're going to send the request as is
and as you can see as a result you're getting the bio of this person.
So you're getting the bio that is relevant to the user that has this I. D.
Now as you can see the idea is very very long.
So naturally you're going to think that there is nothing I can
get out of this and all you're gonna do is basically test
the values in here and here for all of the vulnerabilities that
we know from SQL injection to access S and so on.
But you should also try to just load normal I. Ds.
Even though this idea is really really long.
The web application might still respond to requests
of normal ideas that are not this long.
So for example let's try to load the bio for a user I. D. One.
Let's send it.
And perfect as you can see,
we actually got the bio for a completely different user test account for Xan O.
Now we can try to do set this to zero,
see if we can get anything for the admin because the admin sometimes have zero.
And this is saying this user account doesn't exist if we try to.
It's given us the bio for account to.
So as you can see now we're actually able to load data that belong
to other users and therefore we have
discovered a broken access control vulnerability.
So we discovered an insecure direct object reference or an ID. Or vulnerability.