1"use strict";(self.webpackChunkpentix=self.webpackChunkpentix||[]).push([[8577],{942:(i,e,a)=>{a.r(e),a.d(e,{assets:()=>l,contentTitle:()=>t,default:()=>h,frontMatter:()=>o,metadata:()=>n,toc:()=>c});const n=JSON.parse('{"id":"docs/Interview questions/Javoblar/Insecure direct object references IDOR","title":"Insecure direct object references IDOR","description":"IDOR \u2014 bu access control (kirish nazorati) bilan bog\u2018liq zaiflik bo\u2018lib, foydalanuvchidan kelgan ma\'lumotlar (masalan, userid, file=123.txt, invoiceid) to\u2018g\u2018ridan-to\u2018g\u2018ri serverdagi resurslarga ulanadi hech qanday tekshiruvsiz.","source":"@site/docs/docs/Interview questions/Javoblar/Insecure direct object references IDOR.md","sourceDirName":"docs/Interview questions/Javoblar","slug":"/docs/Interview questions/Javoblar/Insecure direct object references IDOR","permalink":"/docs/docs/Interview questions/Javoblar/Insecure direct object references IDOR","draft":false,"unlisted":false,"editUrl":"https://github.com/acadbek/pentesting-notes/docs/docs/Interview questions/Javoblar/Insecure direct object references IDOR.md","tags":[],"version":"current","frontMatter":{},"sidebar":"tutorialSidebar","previous":{"title":"IDS va IPS nima","permalink":"/docs/docs/Interview questions/Javoblar/IDS va IPS/IDS va IPS nima"},"next":{"title":"Linux terminal vs Windows CMD \u2014 falsafa va hamma jihatlari","permalink":"/docs/docs/Interview questions/Javoblar/Linux Terminal VS Windows cmd"}}');var r=a(4848),s=a(8453);const o={},t=void 0,l={},c=[{value:"Qayerdan chiqqan bu nom?",id:"qayerdan-chiqqan-bu-nom",level:2},{value:"IDOR misollari",id:"idor-misollari",level:2},{value:"IDOR oldini olish",id:"idor-oldini-olish",level:2}];function d(i){const e={blockquote:"blockquote",code:"code",h1:"h1",h2:"h2",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.R)(),...i.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsxs)(e.p,{children:[(0,r.jsx)(e.strong,{children:"IDOR"})," \u2014 bu access control (kirish nazorati) bilan bog\u2018liq zaiflik bo\u2018lib, foydalanuvchidan kelgan ma'lumotlar (masalan, ",(0,r.jsx)(e.code,{children:"user_id"}),", ",(0,r.jsx)(e.code,{children:"file=123.txt"}),", ",(0,r.jsx)(e.code,{children:"invoice_id"}),") to\u2018g\u2018ridan-to\u2018g\u2018ri serverdagi resurslarga ulanadi hech qanday tekshiruvsiz."]}),"\n",(0,r.jsx)(e.p,{children:"Bu zaiflik foydalanuvchiga o\u2018ziga tegishli bo\u2018lmagan ma\u2019lumotlarni ko\u2018rish, o\u2018zgartirish yoki o\u2018chirish imkonini beradi."}),"\n",(0,r.jsx)(e.h2,{id:"qayerdan-chiqqan-bu-nom",children:"Qayerdan chiqqan bu nom?"}),"\n",(0,r.jsxs)(e.p,{children:["IDOR termini birinchi marta ",(0,r.jsx)(e.strong,{children:"OWASP Top 10"})," 2007 ro\u2018yxatida paydo bo\u2018lgan. Aslida bu \u2014 noto\u2018g\u2018ri ",(0,r.jsx)(e.strong,{children:"access control implementatsiyasining"})," bir ko\u2018rinishi, lekin juda keng tarqalgan."]}),"\n",(0,r.jsxs)(e.p,{children:[(0,r.jsx)(e.strong,{children:"IDOR odatda:"}),"\nGorizontal privilege escalation (oddiy foydalanuvchi boshqa foydalanuvchi roliga o\u2018tadi),\nBa'zida esa vertikal escalation (oddiy foydalanuvchi admin bo\u2018lib ketadi) uchun ishlatiladi."]}),"\n",(0,r.jsx)(e.h2,{id:"idor-misollari",children:"IDOR misollari"}),"\n",(0,r.jsx)(e.p,{children:"Ma\u2019lumotlar bazasiga to\u2018g\u2018ridan-to\u2018g\u2018ri murojaat\nSaytda quyidagi URL orqali user profiliga kiriladi:"}),"\n",(0,r.jsx)(e.pre,{children:(0,r.jsx)(e.code,{children:"https://insecure-website.com/customer_account?customer_number=1\n"})}),"\n",(0,r.jsxs)(e.p,{children:["Bu yerda customer_number to\u2018g\u2018ridan-to\u2018g\u2018ri bazadan malumot olish uchun ishlatiladi. Agar serverda hech qanday tekshiruv bo\u2018lmasa, attacker ",(0,r.jsx)(e.code,{children:"customer_number=2"})," qilib, boshqa foydalanuvchining profilinga kirishi mumkin."]}),"\n",(0,r.jsx)(e.p,{children:"Natija: Horizontal privilege escalation."}),"\n",(0,r.jsxs)(e.p,{children:[(0,r.jsx)(e.strong,{children:"IDOR"})," \u2014 bu access control zaifligi bo\u2018lib, foydalanuvchi o\u2018ziga tegishli bo\u2018lmagan resurs ID'sini URL yoki parametr orqali o\u2018zgartirib, boshqa odamning ma'lumotiga kirishi."]}),"\n",(0,r.jsxs)(e.blockquote,{children:["\n",(0,r.jsxs)(e.p,{children:["Misol: ",(0,r.jsx)(e.code,{children:"user_id=5"})," ni ",(0,r.jsx)(e.code,{children:"user_id=6"})," ga o\u2018zgartirib, boshqa user profilinga kirishi."]}),"\n"]}),"\n",(0,r.jsx)(e.h2,{id:"idor-oldini-olish",children:"IDOR oldini olish"}),"\n",(0,r.jsx)(e.h1,{id:"access-control-tekshiruvlarini-implementatsiya-qilish",children:"Access control tekshiruvlarini implementatsiya qilish"}),"\n",(0,r.jsx)(e.p,{children:"Har bir foydalanuvchi harakatidan oldin backend tekshirishi kerak:"}),"\n",(0,r.jsxs)(e.ul,{children:["\n",(0,r.jsx)(e.li,{children:"\u201cBu foydalanuvchi bu resursga haqiqatan ham kira oladimi?\u201d"}),"\n"]}),"\n",(0,r.jsxs)(e.p,{children:["Misol:\nAgar user ",(0,r.jsx)(e.code,{children:"user_id=5"})," bo\u2018lsa, va URL ",(0,r.jsx)(e.code,{children:"user_id=6"})," deb o\u2018zgartirilsa, backend bu 6 raqamli ma\u2019lumotga faqat ",(0,r.jsx)(e.code,{children:"user_id=6"})," bo\u2018lsa kirishini ruxsat qilishi kerak."]}),"\n",(0,r.jsxs)(e.p,{children:["Objekt identifikatorlarini yashirish yoki murakkablashtirish\n",(0,r.jsx)(e.code,{children:"https://example.com/user/7839c123-4f3d-4d25-8e99-1831f79c59f4"})]}),"\n",(0,r.jsx)(e.p,{children:"Backendda autentifikatsiya va avtorizatsiyani har doim tekshirish\nFrontenddagi cheklovlar yetarli emas. Hamma narsa server tomonida tekshirilishi shart."})]})}function h(i={}){const{wrapper:e}={...(0,s.R)(),...i.components};return e?(0,r.jsx)(e,{...i,children:(0,r.jsx)(d,{...i})}):d(i)}},8453:(i,e,a)=>{a.d(e,{R:()=>o,x:()=>t});var n=a(6540);const r={},s=n.createContext(r);function o(i){const e=n.useContext(s);return n.useMemo((function(){return"function"==typeof i?i(e):{...e,...i}}),[e,i])}function t(i){let e;return e=i.disableParentContext?"function"==typeof i.components?i.components(r):i.components||r:o(i.components),n.createElement(s.Provider,{value:e},i.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.