diff --git a/.gitignore b/.gitignore index 92136a2..6d52d02 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,4 @@ *.DS_Store *.vscode */.git -*/.idea/ +.idea/ diff --git a/Filter/Proxy/HTTP/Attack Vectors - IDOR.bambda b/Filter/Proxy/HTTP/Attack Vectors - IDOR.bambda index db577df..bc52875 100644 --- a/Filter/Proxy/HTTP/Attack Vectors - IDOR.bambda +++ b/Filter/Proxy/HTTP/Attack Vectors - IDOR.bambda @@ -6,28 +6,37 @@ **/ List idorList = Arrays.asList("account","doc","edit","email","group","id","key","no","number","order","profile","report","user"); StringBuilder builder = new StringBuilder(); +StringBuilder idorParamsBuilder = new StringBuilder(); HttpRequest request = requestResponse.request(); if (request.hasParameters()){ - boolean foundIdorParam = false; + boolean foundIdorParam = false; for (ParsedHttpParameter parameter : request.parameters()){ String parameterName = parameter.name(); String parameterValue = parameter.value(); - // check if one of the above params is in the request if (idorList.contains(parameterName)) { foundIdorParam = true; + idorParamsBuilder.append(parameterName + ", "); } - // Look for UUIDs. Will add more UUID versions later - // Will add them to the notes tab of the request in Burp + Matcher m = Pattern.compile("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",Pattern.CASE_INSENSITIVE).matcher(parameterValue.toString()); while (m.find()) { - builder.append(m.group() + " "); + builder.append(m.group() + " "); // Append the found UUID to the string } } + StringBuilder notes = new StringBuilder(); + if (idorParamsBuilder.length() > 0) { + notes.append("\n\nPossible IDOR params identified:\n").append(idorParamsBuilder.toString().replaceAll(", $", "")).append("\n"); + } if (builder.length() > 0) { - requestResponse.annotations().setNotes(builder.toString()); + notes.append("\n\nPossible UUIDs identified for an IDOR attack: ").append(builder.toString()); + } + + // Update the notes in the request + if (notes.length() > 0) { + requestResponse.annotations().setNotes(notes.toString()); } return foundIdorParam || builder.length() > 0;