Insecure Direct Object Reference (IDOR)

Fuzzeando parámetros conocidos
Ffuf
# GET request
ffuf -c -w $WORDLIST -u $URL/admin/admin.php?FUZZ=key [$FILTER]
​
# POST (KEY/VALUE)
ffuf -c -w $WORDLIST -u $URL/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' [$FILTER]

Logic Flaws

Path Traversal

Última actualización 1yr ago