🔐 Can you access files that aren't meant for you?

🔍 IDOR Explorer - Complete Solution

🔍 Step 1: Initial Application Analysis

Navigate to http:// to access the SecureFiles document management system. The main interface displays:

The application uses predictable numeric identifiers in the URL parameters, which is a classic indicator of potential IDOR vulnerabilities.

🔍 Step 2: Understanding the Server-Side Vulnerability

This is a real IDOR vulnerability with server-side authorization bypass. The Flask application checks if files exist but fails to verify if the current user has permission to access them:

# Vulnerable code pattern:
# if file_id not in FILES_DB:
#     return error
# return FILES_DB[file_id]  # Missing authorization check!

Key observations:

• Sequential IDs: Files use consecutive numeric identifiers (1001, 1002, 1003)
• Missing Authorization: Server only checks file existence, not user permissions
• Direct Object Reference: Internal database IDs exposed in URLs
• Predictable Pattern: Administrative files likely use lower ID numbers

🔍 Step 3: Testing Authorized Access

First, verify normal functionality by accessing the authorized files:

Each authorized file returns:

• HTTP 200 status code
• Document content (personal files, meeting notes, project documents)
• Owner shown as "user123" (matching current user)
• No unauthorized access warnings

🔍 Step 4: IDOR Enumeration Strategy

Based on the sequential pattern (1001-1003), test adjacent and logical ID ranges:

🔍 Step 5: Identifying the IDOR Vulnerability

Through systematic enumeration, discover that file ID 1 returns different content:

This request reveals:

🔍 Step 6: Flag Extraction from Server Response

The administrative configuration file (ID: 1) contains the flag in the server-generated response:

SYSTEM CONFIGURATION FILE
========================
Application: SecureFiles v2.1
Owner: admin
Classification: CONFIDENTIAL

Security Settings:
- Authentication: Enabled
- Authorization: Basic ID-based (VULNERABLE!)
- Encryption: AES-256
- Audit Logging: Disabled

System Flag: [FLAG_UUID_HERE]

User Permissions:
- user123: files 1001-1003
- admin: files 1-100
- guest: files 2001-2100

The flag is clearly displayed in the "System Flag" field as a UUID format, served directly by the Flask application.

🔍 Step 7: Browser-Based Exploitation

The IDOR vulnerability can also be exploited through browser manipulation:

1. Access any authorized file through the web interface
2. Observe the URL: http:///view?file=1001
3. Manually change the file parameter to 1 in the address bar
4. Press Enter to navigate to: http:///view?file=1
5. The browser displays the administrative configuration file with unauthorized access warning
6. The flag is visible in the system configuration section

🔍 Step 8: API Endpoint Exploitation

The application also exposes an API endpoint with the same IDOR vulnerability:

🔍 Step 9: Server-Side Logging Analysis

The Flask application logs unauthorized access attempts, which would be visible in server logs:

This demonstrates how IDOR vulnerabilities can be detected through proper logging and monitoring.

🔍 Real IDOR Vulnerability Analysis

This challenge demonstrates a genuine server-side IDOR vulnerability:

🛡️ Security Implications and Remediation

📚 Key Learning Points

• Real IDOR Understanding: Server-side authorization bypass vs client-side display logic
• Systematic Enumeration: Methodical testing of ID ranges and patterns
• Authorization vs Authentication: Understanding the critical difference
• Multi-Vector Testing: Web interface, API endpoints, and direct requests
• Security Logging: Importance of monitoring and detecting unauthorized access