Security Series Workshop A4: Insecure Direct Object References

Vulnerability overview

OWASP Top 10 2013 Item A4: Insecure Direct Object References

Setup

Install Rust

Run this command to launch rustup, the Rust installer.

curl https://sh.rustup.rs -sSf | sh

You will see these options:

1) Proceed with installation (default)
2) Customize installation
3) Cancel installation

Choose option 2 for a customized installation. We need the nightly toolchain, so choose that; for the other prompts, just hit enter to keep the defaults. When it shows you the options again, choose 1 to install (even though it incorrectly still says (default), it should install the nightly).

Note that by default it will add $HOME/.cargo/bin to your PATH by modifying $HOME/.profile; feel free to adjust this after the fact if it doesn't suit you (or tell it to skip it and do it yourself how you want).

Clone and run the demo

Make sure you have Docker running.

# Clone this repo
git clone git@github.com:snargleplax/webrust
cd webrust

# Check out the branch for this workshop
git checkout owasp-a4

# Create and run the database
make create && make start

# Run the web server (cargo is the Rust build tool)
cargo run

Exercise

Discover and exploit an insecure direct object reference security vulnerability.

BONUS: Fix it.

See target system README.md.

Tools

TODO: some resources will be provided to facilitate the exercise.

Teardown

When you're done, decommission the workshop environment:

# Stop and tear down the DB
make stop && make remove