# IDOR / BOLA

{% hint style="info" %}
**Insecure Direct Object Reference (IDOR)** or **Broken Object Level Authorization (BOLA)** is a vulnerability where an attacker can access or manipulate resources they shouldn't be able to, by altering identifiers in requests (e.g., URLs, form fields).
{% endhint %}

{% hint style="danger" %}
This can lead to unauthorized access to sensitive data or actions, as attackers can exploit insufficient access controls to view or modify other users' data.
{% endhint %}

{% hint style="success" %}
Implement proper access controls and authorization checks on the server side, validate and restrict access to resources based on user roles, and avoid exposing direct references to sensitive objects.
{% endhint %}

IDORs can be categorized as:

1. **Static File IDORs**: When the application uses easily guessable IDs in URLs to access files or data.

```bash
# referencing a data file's object
http://idor-sandbox/docs/?f=1.txt
# routing example
/users/:userIdent/documents/:pdfFile
/users/18293017/documents/file-15
```

2. **Database Object Referencing IDORs (ID-Based)**: When an endpoint insecurely references database objects by their IDs, allowing unauthorized access.

```bash
# Numeric value
http://idor-sandbox:80/customerPage/?custId=1
# Unique Identifier (UID)
http://idor-sandbox:80/user/?uid=16327
# Universal Unique Identifier (UUID)
http://idor-sandbox:80/userProfile/a8e62d80-42cc-4ac6-bf53-d28a0ff61a82 
```

## API Key Access <a href="#api-key-access" id="api-key-access"></a>

> _The example below is based on PostSwigger's_ [_User ID controlled by request parameter_](https://portswigger.net/web-security/access-control/lab-user-id-controlled-by-request-parameter) _lab._

When we log into the application with the user `wiener`, we can directly see his API key (Figure 1).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FpvBJ48IuTLisHFp67uIG%2Fweb_bola_1.png?alt=media&#x26;token=2850600b-3763-400a-8163-bdec37adf21e" alt=""><figcaption><p>Figure 1: Obtaining <code>wiener</code>'s API key.</p></figcaption></figure>

It seems that the `session` cookie is not tied to a specific user. As a result, we can access `carlos`'s API key by forwarding the latter request in the Repeater and changing the `id` parameter (Figure 2).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2F8FvPBMoAYb5h39FYOkOZ%2Fweb_bola_2.png?alt=media&#x26;token=8d12f5c6-0fe8-4649-b6e1-2bd33fa61629" alt=""><figcaption><p>Figure 2: Discovering a BOLA vulnerability &#x26; obtaining the API key of another user.</p></figcaption></figure>

## Logs Access <a href="#logs-access" id="logs-access"></a>

> _The example below is based on PostSwigger's_ [_Insecure direct object references_](https://portswigger.net/web-security/access-control/lab-insecure-direct-object-references) _lab._

This application has a Live Chat functionality which also provides the ability to view a chat's transcript. The latter feature reveals the directory where the transcript is stored (Figure 3).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2Fm7noBYtbSRG1ruzIs8BG%2Fweb_bola_3.png?alt=media&#x26;token=8a50d74a-70f8-4178-b6ac-445f193fa710" alt=""><figcaption><p>Figure 3: Viewing the transcript of our Live Chat reveals where it is stored.</p></figcaption></figure>

Similar to the [previous example](https://x7331.gitbook.io/notes/tcm/web-testing/authorization/bola#api-key-access), the session cookie is not tied to a specific user and their transcripts. Thus, we can brute-force the `/download-transcript` directory and access them all (Figure 4).

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FFoqqbKfTvi4oOaVTeo4f%2Fweb_bola_4.png?alt=media&#x26;token=30ed3c94-7aae-4792-88d6-c1aab8ae57ff" alt=""><figcaption><p>Figure 4: Brute-forcing other users' transcripts.</p></figcaption></figure>
