Academia.eduAcademia.edu

Figure 2 – uploaded by ISECURE Journal

See full PDFdownloadDownload figure
Table 1. Comparison of black-box IDOR detection methods

Table 1 Comparison of black-box IDOR detection methods

Related Figures (7)

Figure 1. General approaches for IDOR prevention
Figure 1. General approaches for IDOR prevention
Figure 3. Venn diagram for (a) a successful passive attack (b) an unsuccessful passive attack
Figure 3. Venn diagram for (a) a successful passive attack (b) an unsuccessful passive attack
For the valuation of Get or each role using the Scra Boo and RailsGoat, IDOT together with XAMPP was installed on a virtual ma- chine having Ubuntu (version 16.04) operating system with about 83GB RAM and two processing cores. we first perform a crawling process in separate sessions py framework as described in Section 4.1.1. Then, the information gathered in the crawling phase is used for the attack and anal- ysis phases by IDOT. The evaluation time for each of our case studies takes a not short for such small a attack and analysis time c intervention in choosing a bout 30 minutes, which is pplications. However, the an be reduced by manual subset of parameters for manipulation (instead of trying all possible parame- ter manipulations). Also, s ince the bottleneck is pro- Figure 6. Trees corresponding to (a) Arash’s page and (b) Ramin’s page
For the valuation of Get or each role using the Scra Boo and RailsGoat, IDOT together with XAMPP was installed on a virtual ma- chine having Ubuntu (version 16.04) operating system with about 83GB RAM and two processing cores. we first perform a crawling process in separate sessions py framework as described in Section 4.1.1. Then, the information gathered in the crawling phase is used for the attack and anal- ysis phases by IDOT. The evaluation time for each of our case studies takes a not short for such small a attack and analysis time c intervention in choosing a bout 30 minutes, which is pplications. However, the an be reduced by manual subset of parameters for manipulation (instead of trying all possible parame- ter manipulations). Also, s ince the bottleneck is pro- Figure 6. Trees corresponding to (a) Arash’s page and (b) Ramin’s page
Figure 5. The pages for user Arash (a) and user Ramin (b)
Figure 5. The pages for user Arash (a) and user Ramin (b)
Figure 7. The tree obtained by (a) a - b and (b) anb
Figure 7. The tree obtained by (a) a - b and (b) anb
Table 2. Test results of RailGoat GetBoo is our second case study. It is a web ap- plication for managing user bookmarks including 35 passive and 15 active requests. Running IDOT on Getboo resulted in detecting only a vulnerable pas- sive request. The vulnerable request opens the re- ated link in a stored bookmark. For example, as- sume wu; has stored a bookmark b with an access link http://getboo.com/redirect.php7id=9. Now, if ua uses this link in his request, he can get access to u,’s bookmark. No other vulnerable request is detected by IDOT. The result obtained through manual tests performed by the human expert also confirms that no other IDOR vulnerability exists in this application. Table 3 summarizes the results of testing GetBoo by DOT.
Table 2. Test results of RailGoat GetBoo is our second case study. It is a web ap- plication for managing user bookmarks including 35 passive and 15 active requests. Running IDOT on Getboo resulted in detecting only a vulnerable pas- sive request. The vulnerable request opens the re- ated link in a stored bookmark. For example, as- sume wu; has stored a bookmark b with an access link http://getboo.com/redirect.php7id=9. Now, if ua uses this link in his request, he can get access to u,’s bookmark. No other vulnerable request is detected by IDOT. The result obtained through manual tests performed by the human expert also confirms that no other IDOR vulnerability exists in this application. Table 3 summarizes the results of testing GetBoo by DOT.
Table 3. Test results of GetBoo >» Conclusion and Future Work
Table 3. Test results of GetBoo >» Conclusion and Future Work
580 California St., Suite 400
San Francisco, CA, 94104
© 2025 Academia. All rights reserved