12/9/2022 - THM Auth Bypass, Logic Flaw, Cookies, IDOR

Question 1

What is Directory Traversal attack?

Answer 1

Using web app user inputs to traverse web server

Question 2

Types of File Inclusion

Answer 2

Remote FI
Local FI

Question 3

What PHP functions does Local FI leverage?

Answer 3

Include
Require
include_once
require_once

Question 4

What is IDOR

Answer 4

Insecure Direct Object Reference:
Access control vulnerability that is supplied by user to access resources

Question 5

Example(s) of IDOR

Answer 5

Viewing online (profiles, orders, policy, etc..) by switching user_id

Create two accounts on the same website and swap IDs

Question 6

How can IDORs be Obfuscated?

What two key areas are they usually found in?

Answer 6

Base64 Encoding (Obfuscation)
Hashed IDs (Obfuscation)

AJAX requests
Cookies

Question 7

What are mitigation techniques against Directory Traversal Attacks

Answer 7

Keep systems patched

Turn off PHP errors to prevent revealing sensitive system info

WAFs

Disable PHP features that cause file inclusion (ie allow_url_fopen, allow_url_include)

Input Validation

Implement whitelisting and blacklisting of filenames and locations