Lab 5: Advanced Parameter Manipulation

Difficulty: High

Lab Overview

This lab demonstrates advanced IDOR vulnerabilities using various parameter manipulation techniques. The application implements different methods of parameter handling that can be bypassed using creative manipulation techniques.

Objective: Use advanced parameter manipulation techniques to bypass IDOR protections and access unauthorized data.

Vulnerable PHP Code

// Advanced parameter manipulation techniques
switch ($technique) {
    case 'basic':
        // Basic IDOR - direct parameter manipulation
        if ($param1 && isset($data_sources['users'][$param1])) {
            $data = $data_sources['users'][$param1];
        }
        break;
        
    case 'encoded':
        // Encoded parameter manipulation
        $decoded_param = base64_decode($param1);
        if ($decoded_param && isset($data_sources['users'][$decoded_param])) {
            $data = $data_sources['users'][$decoded_param];
        }
        break;
        
    case 'hash':
        // Hash-based parameter manipulation
        if ($param1) {
            $hash = md5($param1);
            // Simulate hash-based lookup
        }
        break;
        
    case 'json':
        // JSON parameter manipulation
        if ($param1) {
            $json_data = json_decode($param1, true);
            if ($json_data && isset($json_data['id'])) {
                $data = $data_sources['users'][$json_data['id']];
            }
        }
        break;
}

Advanced Parameter Manipulation

Basic IDOR - User data loaded!

Quick Test URLs:

Manipulated Data: Basic Technique ADVANCED BYPASS

Manipulated Data

{
    "id": 1,
    "name": "John Doe",
    "role": "user",
    "department": "IT"
}

Vulnerability Details

Type: Advanced Insecure Direct Object Reference (IDOR)
Severity: Critical
Parameters: technique, param1, param2, param3
Method: GET
Issue: Advanced parameter manipulation without proper validation

Test Payloads by Technique

Basic: param1=1

Encoded: param1=MQ== (base64 encoded "1")

Array: param1=1¶m2=2

Hash: param1=1 (uses MD5 hash)

JSON: param1={"id":1}

Chained: param1=1¶m2=1¶m3=test

Bypass: param1=1%00 (null byte injection)

Quick Test URLs

Click these links to test different manipulation techniques:

Advanced Attack Scenarios

Bypassing WAF and security filters
Advanced encoding and obfuscation techniques
Parameter pollution and injection attacks
Multi-stage payload delivery
Context-aware injection attacks
Client-side security control bypasses
Privilege escalation and persistence

Advanced Mitigation Strategies

Implement multiple layers of validation and sanitization
Use whitelist-based validation instead of blacklists
Normalize and canonicalize input before validation
Implement proper parameter validation and restriction
Use least privilege principles
Implement proper error handling
Regular security testing and filter updates
Consider using a WAF (Web Application Firewall)
Implement network segmentation and access controls