Challenge Name: OnlyHacks Level: Very Easy Vulnerability: Insecure Direct Object Reference (IDOR)
Introduction
OnlyHacks is a web-based challenge that simulates a dating platform where users can interact with each other. The goal is to exploit an Insecure Direct Object Reference (IDOR) vulnerability using Burp Suite to access restricted information and retrieve the flag.
Step 1: Initial Setup
Access the Challenge:
Navigate to the provided URL for the OnlyHacks challenge.
Create a new account using the registration form.
Step 2: Identifying the Vulnerability
Explore the Platform:
After logging in, you are directed to the chat interface.
Select every user to start a conversation.
Press enter or click to view image in full size
Capture the Chat Request:
With Burp Suite intercepting, initiate a chat and capture the request.
You should see a request similar to:
GET /chat/?rid=6 HTTP/1.1 Host: 83.136.249.46:39967 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 15_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://83.136.249.46:39967/chat/ Sec-GPC: 1 Connection: close
The rid parameter appears to be a user or chat room identifier.
Send to Repeater:
Right-click the request and send it to Burp Suite’s Repeater for further analysis.
Step 3: Exploiting the IDOR with Burp Suite
Manual Testing in Repeater:
In the Repeater tab, modify the rid parameter to different values (e.g., 1, 2, 3).
Send the requests and observe the responses.
Look for a 200 OK status code indicating successful access.
Using Intruder for Brute-Forcing:
Send the request to Burp Suite’s Intruder.
In the Intruder tab, clear all payload positions and set the rid parameter as the payload position.
Configure the payload type to “Numbers” and set the range from 1 to 20 with a step of 1.
Start the Attack:
Begin the attack and monitor the responses.
Look for responses with a 200 OK status code and review the content.
Retrieve the Flag:
Upon finding a successful response (e.g., rid=3), review the chat content.
The flag is revealed within the chat messages:
Press enter or click to view image in full size
Conclusion
The OnlyHacks challenge demonstrates the risks associated with Insecure Direct Object References (IDOR). By using Burp Suite to manipulate the rid parameter, an attacker can access unauthorized data, highlighting the importance of proper access controls in web applications.
