A penetration tester observes an application enforcing strict access controls. Which of the following would allow the tester to bypass these controls and successfully access the organization's…

The correct answer is D. Insecure direct object references. Insecure Direct Object Reference (IDOR) vulnerabilities occur when an application provides direct access to objects based on user-supplied input. This can allow an attacker to bypass authorization and access resources in the system directly, for example database records or…

Attacks and Exploits

Question

A penetration tester observes an application enforcing strict access controls. Which of the following would allow the tester to bypass these controls and successfully access the organization's sensitive files?

Options

ARemote file inclusion
BCross-site scripting
CSQL injection
DInsecure direct object references

How the community answered

(23 responses)

A
9% (2)
B
17% (4)
C
4% (1)
D
70% (16)

Explanation

Insecure Direct Object Reference (IDOR) vulnerabilities occur when an application provides direct access to objects based on user-supplied input. This can allow an attacker to bypass authorization and access resources in the system directly, for example database records or files. In this case, the penetration tester could potentially bypass the strict access controls and access the organization's sensitive files.

Topics

#Web application vulnerabilities#Access control bypass#IDOR#Exploitation techniques

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice