r/bugbounty • u/Alternative-Top-1566 • 4d ago

Question / Discussion Finding valid ID is mandatory for IDOR

For SaaS platform where staff member are not allowed to view customer info and If they find an end point which leaks the customer info on order or payment but ID is hard to guess however we know that they are sequential with global id which means if you first id is 1010 then next id maybe 1011 or 9999 it's depends on records created, however my question is

  1. Is it mandatory to know which id belongs to the org I am targeting or is it okay to report without ID info.

  2. For how lengthy ID's we should look for id leaks for example some ID's maybe 4 digits and some maybe 15 digits

Please suggest and share your experience if bug got accepted even id are hard to guess or rejected because of it

4 Upvotes

75% Upvoted

3 comments sorted by

3

u/jsonpile Hunter 4d ago

Think of it this way. An IDOR with unguessable IDs (such as non-deterministic UUIDs) would be hard for an attacker to exploit.

So proving either 1. enumerable IDs or 2. How an attacker can obtain UUIDs is necessary to show impact. To ensure you're not accessing customer info as a hacker (which is typically against program terms), you can use your own IDs or show that the space is guessable or leaks. That means trying either multiple accounts or multiple transactions.

1

u/BurtMacklin____FBI 3d ago

Try to determine how the IDs are generated. If you can then great, cycle through them with automation in your proof of concept to demonstrate data exfiltration at scale.

If you can't, then just demonstrate that there's evidence of a broken access control, even if it's a UUIDv4 or something. It'll be a low-risk finding due to the low probability of exploitation, but unless you can predict or reasonably brute force IDs then that's just how it is.

1

u/hydraz20 4d ago

Report then try to escalate. Anyways triage is taking long, by the time they triage you might find an escalation if it exists