mitm-find-idor（中间人找到 idor）

Find IDOR Vulnerabilities

Analyze the mitmproxy dump (log.txt) for IDOR vulnerabilities for: $ARGUMENTS

Requires: log.txt in the current directory. If it's missing, capture traffic first: ``bash mitmdump --set flow_detail=3 2>&1 | tee log.txt ``

High-Value IDOR Patterns (from 132 real HackerOne bounty reports)

1. User/Account Object References

user_id, userId, user-id, uid, account_id, accountId
customer_id, customerId, member_id, memberId
profile_id, owner_id, creator_id, author_id

Real example: https://zomato.com/gold/payment-success?subscription_id=XXX&user_id=YYY

2. Resource Object References

order_id, orderId, booking_id, bookingId, reservation_id
transaction_id, txn_id, payment_id, invoice_id
document_id, doc_id, file_id, attachment_id
report_id, ticket_id, case_id, issue_id

Real example: /api/shopify/orders/{order_id} - change order_id to access other orders

3. Organizational Object References

project_id, projectId, team_id, teamId, group_id, groupId
workspace_id, org_id, organization_id, company_id
board_id, channel_id, room_id, space_id

Real example: PUT /boards/{board_id}.json - GitLab private project label access

4. Content Object References

media_code, media_id, image_id, video_id, asset_id
post_id, postId, comment_id, message_id, thread_id
article_id, content_id, item_id, entry_id

Real example: media_code=2013124 - sequential IDs expose other users' media

5. Session/Token References (High Impact)

session_id, sessionId, subscription_id, subscriptionId
card_id, cardId, fuel_card_id, membership_id
api_key_id, token_id, credential_id

Real example: activateFuelCard?id=XXX - Uber driver UUID enumeration

ID Encoding Patterns to Decode

Where to Find IDORs

URL Path Parameters (Most Common)

/api/v1/users/{id}/profile
/api/v1/orders/{id}/details
/api/v1/documents/{id}/download
/campaign-manager-api/accounts/{id}

Query Parameters

?user_id=12345&action=view
?subscription_id=XXX&user_id=YYY
?media_code=2013124

Request Body (JSON/Form)

{"user_id": 12345, "action": "delete"}
{"board": {"id": 857058, "labels": [{"id": 123}]}}

Headers (Rare but High Impact)

X-User-Id: 12345
X-Account-Id: 67890

Severity Rating

Testing Methodology

Step 1: Identify Candidate Parameters

Search for ID patterns in traffic:

grep -iE '(user|account|order|session|subscription|member|card|document|file|project|team|group)[-_]?id' log.txt

Step 2: Check for Sequential/Predictable IDs

# Extract numeric IDs and check if sequential
grep -oE 'id[=:]["'\'']?[0-9]+' log.txt | sort -u

Step 3: Test Authorization

# Test with ID ± 1
curl -H "Cookie: victim_session" "https://target.com/api/resource/12345"
curl -H "Cookie: victim_session" "https://target.com/api/resource/12344"  # Another user's

Step 4: Verify Impact

• Does response contain different user's data?
• Can you perform actions (edit/delete) on other user's resources?
• What sensitive fields are exposed?

Output Format

For each finding report:

## IDOR Finding: [Brief Description]

**Endpoint**: `METHOD https://target.com/path`
**Parameter**: `param_name` in [path|query|body]
**ID Type**: [Sequential|Base64|UUID|Hash]
**Current Value**: `12345`
**Severity**: [CRITICAL|HIGH|MEDIUM|LOW]

**Evidence**:
[Show request/response snippets]

**Impact**:
- What data is exposed
- What actions can be performed

**Test Command**:
curl -X METHOD 'https://target.com/...' -H 'Cookie: ...'

**Remediation**:
- Implement proper authorization checks
- Use indirect references (mapping table)
- Validate user owns the resource

False Positives to Ignore

• Analytics/tracking endpoints (write-only, no data returned)
• Public content IDs (movie IDs, product catalog)
• Resource IDs that return same data regardless of auth
• IDs that require valid session AND return 403 for wrong user