Bug bounty tips for Broken Access Control using BurpSuite Part 2: Using Autorize and Autorepeater

In this tutorial, you will learn how I test for broken access control and achieve privilege escalation on web applications using BurpSuite extensions AutoRepeater and Autorize. Both of them are free and accessible to everyone, not just Burp Pro users.
Read hacking articles on thehackerish.com
Follow us on Twitter: / thehackerish
Listen to the Podcasts on Anchor: anchor.fm/thehackerish
Thumbnail:
Photo by Chris Barbalis on Unsplash

[@robertonunes8876]

For those who didn't Still understand. This video is so helpful to test BAC. Here is scenario : Only admin got access to use some features on organization.Capture those request in burp while using those features. Now, change the Token id/cookie to low privileged user & sending the request if it get changed the organization settings which they normally can't accessed. Then it's a BUG. You helped me a lot. Thank you ♥️

[@thehackerish]

You nailed it! Good job!

[@robertonunes8876]

Thank you Mate 😊

[@GAPSGraham]

How does this work when you don’t have access to a admin account?

[@sushantdhopat]

Amazing Video😍appreciate your work 👏

[@thehackerish]

Glad you liked it! Enjoy!

[@hackersguild8445]

Nice tutorial. Thanks man.:)

[@thehackerish]

Welcome! :)

[@neetech3716]

Wow!!! Very Good Content 🔥🔥👍 Keep it up 😎

[@thehackerish]

Glad you liked it! Enjoy!

[@albertobarbieri8280]

Hi, Right now I'm using Burp Extension Autorize to test for IDOR. I'm curious if there is any way, or maybe another extension, to make Autorize more automatic. For example, now I click on every button on the site to be sure I got all possible path or api. Then I start analyzing the result to find if there are false positive and I put them out of scope. Then, If I i want to see the effect of removing them from the scope I need to click all again and If the web application is big I can't click again every single time I remove something from the scope. So I would like to know if there is any way to automatically update the list I already done. Thanks :)

[@thehackerish]

Maybe you can exprt all in CSV then grep?

[@pedrampaknia6825]

First, thanks for the amazing content and the simplicity of your teaching methods. Second, when checking for IDOR or Broken access control, I know you have to mess with parameters to see how they change the response, but when you changing jwt token, I need to know how this can affect "real" users of a web application? More specifically how an attacker could get access to someone jwt token to use it in broken access control vulnerability?

[@thehackerish]

Thanks for your question Pedram. We are changing the JWT token here to test if you, as an attacker, can execute the same request on the victim's resources. If it's successful, then you have essentially found a broken access control vulnerability. You don't need the victim's JWT token for that, we are using a second test account to cover as much requests as possible and not affect real victims. For JWT exfiltration, your can use XSS for example. Most of the time, JWT is stored in the Browser's LocalStorage, which is easily accessible using Javascript.

[@m7mds461]

@@thehackerish I made a report in which I was able to replace users A bearer authentication token with users B and I was able to change some information, they responded to me telling me that you haven’t change any other users information, because every user has his own bearer authentication.

[@yashsrivastava20]

@@m7mds461 Bro there is a video of this in insiderPhD channel the most new idor video has your answer in it !

[@all-day-games6465]

dear, how can we report this access control vulnerability in the report, so that they can give us some bounty. can you help me with what exactly should be required to submit during the POC submission. like check which points to be include.

[@thehackerish]

Checkout the video on how to write good reports from the hack for fun and profit playlist.

[@all-day-games6465]

@@thehackerish ok dear

[@raisaabedin4920]

Hello, this video is helpful for understanding BAC for a newbie like me. Thanks. I have questions- 1.when we change the authorization bearer token of victim's with ours (attackers), how the quantity is changed in victim's basket? what happens in background ? as an attacker I pasted my authorization bearer token into victim's request, so is not it supposed to change the attacker's basket? :/ I don't understand the concept. can you elaborate it? 2. In real life , attacker and victim would not use the same browser, then how to intercept victim's https request in burp suite? 3. How to prevent it as a security professional ?

[@thehackerish]

1. how the quantity is changed in victim's basket? Baaed on the basket id. what happens in background? The backend server receives the request, verifies the JWT token is valid, and takes whatever basket id and changes it. It doesn't validate if the user with the token has permission on the basket. 2. how to intercept victim's https request in burp suite? You don't need any interception. As an attacker, you just change the basket id. I'm changing the JWT in this case to easily test IDOR across many requests rather than change the IDs one by one for each and every request. 3. As a developer who is developing securely, you should always validate if the authenticated user has permissions to access/edit/delete a resource before doing any further actions. I hope this helps! Thanks for your questions!

[@raisaabedin4920]

@@thehackerish thank you so much!! It is a great help . ♥️♥️

[@sushantdhopat]

I report the idor issue where I replace my cookie to different account cookie and I still access sensitive information different user but they give me this reply unless you are able to demonstrate how the token/cookie will be accessed/obtained remotely we cannot consider this an issue

[@thehackerish]

If you pay close attention, the vulnerability in the video exists in the basket id from the URL. Changing the JWT is just an easy trick I follow to test the features cross-acount.

[@sushantdhopat]

@@thehackerish i understand so if this possible when the specific endpoint have id . for the automation we are change only the jwt token ????

[@thehackerish]

@@sushantdhopat Exactly! Because one user will be able to act on the resource of the other.

[@sushantdhopat]

@@thehackerish ok thanks for Clarification

[@ajaykumark107]

Please remove the music in the background.

[@thehackerish]

I did in later videos, thanks for your suggestion. Although the majority likes it, I think it is a good idea to just get rid of it to not disturb the rest like you.