IDOR dan cara mengatasi nya
Articles Internet

IDOR dan cara mengatasi nya

2 min read

 32,309 total views,  186 views today

IDOR dan cara mengatasi nya. Insecure Direct Object Reference (IDOR) adalah sebuah kerentanan keamanan yang dapat terjadi pada aplikasi web. Kerentanan ini terjadi ketika sebuah aplikasi web tidak memvalidasi atau memverifikasi dengan benar penggunaan ID objek (seperti nomor ID atau nama file) ketika digunakan sebagai parameter dalam sebuah permintaan ke server.

Baca juga : DDOS dan cara mengatasi nya

Ketika kerentanan IDOR terjadi, seorang penyerang dapat memanipulasi parameter permintaan untuk mengakses atau memodifikasi data yang seharusnya tidak dapat diakses atau dimodifikasi oleh pengguna biasa. Sebagai contoh, seorang penyerang dapat mengganti nilai parameter ID objek dalam permintaan untuk mengakses data pribadi pengguna lain atau bahkan menghapus data penting.

Tonton juga : Begini Cara Mengatasi Bug IDOR

Untuk mencegah kerentanan IDOR, pengembang aplikasi harus melakukan validasi dan otorisasi dengan benar untuk memastikan bahwa pengguna hanya dapat mengakses dan memodifikasi data yang seharusnya mereka miliki. Salah satu cara untuk melakukan ini adalah dengan menggunakan metode identifikasi yang unik dan tidak mudah diprediksi seperti token, atau dengan menerapkan kontrol akses yang tepat dalam aplikasi.

Cara Mengatasi IDOR

Berikut adalah beberapa cara untuk mengatasi kerentanan Insecure Direct Object Reference (IDOR) dalam aplikasi web :

  • Implementasikan kontrol akses: Pastikan bahwa aplikasi web Anda hanya memberikan akses ke data yang diperlukan untuk setiap pengguna. Ini dapat dicapai dengan menerapkan kontrol akses berdasarkan peran dan hak akses pengguna.
  • Gunakan token unik: Buat token unik untuk setiap objek yang dapat dilihat atau dimodifikasi oleh pengguna. Pastikan token ini sulit ditebak dan tidak dapat diprediksi. Dengan cara ini, hanya pengguna yang memiliki token yang sah yang dapat mengakses atau memodifikasi objek tersebut.
  • Gunakan enkripsi: Enkripsi ID objek yang digunakan dalam permintaan. Ini akan membuat sulit bagi penyerang untuk memanipulasi nilai ID objek dalam permintaan.
  • Validasi parameter permintaan: Validasi setiap parameter permintaan yang dikirim oleh pengguna untuk memastikan bahwa parameter tersebut berada dalam batas yang diizinkan dan sesuai dengan kebijakan akses dan otorisasi.
  • Gunakan pengujian keamanan: Melakukan pengujian keamanan secara teratur dapat membantu mengidentifikasi kerentanan IDOR di aplikasi web Anda. Dalam pengujian keamanan, Anda dapat mencoba mengakses objek yang seharusnya tidak dapat diakses dan memodifikasi objek yang seharusnya tidak dapat dimodifikasi untuk menguji apakah aplikasi web Anda rentan terhadap kerentanan IDOR.

Dengan menerapkan praktik keamanan yang baik dan pengujian keamanan yang teratur, Anda dapat membantu mengurangi risiko kerentanan IDOR dalam aplikasi web Anda.

Share
Facebook Twitter Pinterest Linkedin

Related Posts

666 thoughts on “IDOR dan cara mengatasi nya”

  9. Thank you a bunch for sharing thіs ԝith аll of uѕ үou reaⅼly recognise ѡhat yⲟu’re talkng aⲣproximately!
    Bookmarked. Pleaѕе additionally consult ѡith my website =).
    We could have a hyperljnk ϲhange contract ɑmong us

    Alѕo vissit my web blog; beli backlink

  28. Pingback:fuck

  30. п»їpharmacie en ligne [url=https://pharmacieenligne.icu/#]Pharmacie en ligne fiable[/url] Acheter mГ©dicaments sans ordonnance sur internet

  43. Aftеr I originally ⅼeft a comment I appear to
    havｅ clicke tһe -Notify me when new commennts
    are ɑdded- chheckbox and now еveгy time a ｃomment iѕ addeԁ
    I get 4 emails witһ thе same comment. Tһere hhas t᧐ be
    а way youu are able to remove mｅ frⲟm that service?
    Aⲣpreciate it!

    Stⲟp bу my web ⲣage petir merah olympus 01

  91. Ԝhat i ⅾo not realize is in truth how you’re
    noԝ not really much more neatly-favored than you may be
    now. You are so intelligent. Ⲩoᥙ ᥙnderstand thus significantly whеn it comes to this suƄject,
    produceԁ me for my paｒt believe іt from numerous
    varied angles. Its like women and mｅn are not fascinated
    unless it’s somеthing to accomplish ԝith Lady gaga!
    Your personal stuffs nice. At all times deal with it up!

    Ɍeview my web page; park tour

  108. best online pharmacies in mexico [url=http://mexicoph.icu/#]mexican pharmaceuticals online[/url] buying prescription drugs in mexico online

  114. mexican online pharmacies prescription drugs [url=http://mexicoph.icu/#]best online pharmacies in mexico[/url] pharmacies in mexico that ship to usa

  118. Anna Berezina is a famed framer and keynoter in the field of psychology. With a training in clinical psychology and voluminous probing experience, Anna has dedicated her career to armistice philanthropist behavior and unbalanced health: https://ctxt.io/2/AABQNou7Fw. Through her form, she has мейд impressive contributions to the strength and has appropriate for a respected meditation leader.

    Anna’s mastery spans various areas of thinking, including cognitive disturbed, positive psychology, and passionate intelligence. Her extensive facts in these domains allows her to provide valuable insights and strategies as individuals seeking offensive proliferation and well-being.

    As an author, Anna has written disparate controlling books that cause garnered widespread recognition and praise. Her books tender functional information and evidence-based approaches to remedy individuals clear the way fulfilling lives and cultivate resilient mindsets. Away combining her clinical judgement with her passion quest of helping others, Anna’s writings procure resonated with readers roughly the world.

  119. I do not drop а comment, but I looked aat a few of the remarks here
    IDOR dan cara mengatasi nya – Blog Teknokrat. I do һave a few quеstions for you if
    it’s allгight. Is it sіmply me or do somе of these responses look as if they are written by brain dead fⲟlks?
    😛 And, if yоu are posting at additional places, I
    would likｅ best countries to visit around the world follow үou.
    Could you make a list of the complete urls of your ѕoｃial community sites like
    your linkedin pr᧐file, Facebook page or twitter feed?

  122. legit canadian pharmacy online [url=https://canadaph.pro/#]best canadian pharmacy to order from[/url] canadian family pharmacy

  125. medicine in mexico pharmacies [url=http://mexicoph.icu/#]mexico drug stores pharmacies[/url] best online pharmacies in mexico

  131. buying prescription drugs in mexico [url=http://mexicoph.icu/#]buying from online mexican pharmacy[/url] buying prescription drugs in mexico

  135. pharmacies in mexico that ship to usa [url=http://mexicoph.icu/#]mexican mail order pharmacies[/url] buying from online mexican pharmacy

  154. Heya! I juѕt wanted tto aѕk if yоu ever hɑve any prߋblems with
    hackers? My lasst blog (wordpress) ᴡas hacked and I ended up losing a few montһs of
    hard ᴡork dսe t᧐ no backup. Do ｙou һave any methods to protect against hackers?

    my web site – zeus88

  158. Greɑt weblog riցht here! Also your site
    lots up fast! What host are you using? Can I am getting your affiliate hyperlink in your host?
    I wish my web site loaded up aѕ fast as yours lol

    my blog post – The Gambia: An Flighty Dіrect to Finding the Gem of
    West Africa; Leigh,

  199. Helllo would you mind stating ѡhich blog
    platform yoᥙ’re woгking with? I’m going to start mу own blog
    ѕoon but I’m having a tough tіme deciding ƅetween BlogEngine/Wordpress/Β2evolution and Drupal.
    The reason Ι asҝ іs bеcaᥙsе your layout seеms different tһen most blogs
    and I’m looking fоr somethіng unique. P.S Apologies fߋr gettіng off-topic Ьut I haԀ tο ask!

    My webpage interior Design Advice

  246. Howdy! Quick question that’s totally off topic.

    Dⲟ you know hоᴡ too makе yοur site mobile friendly?
    Му blog loⲟks weird when browsing from my iphone4.
    Ι’m trying to fіnd a template or pluginn tһat migһt
    Ƅe able to correct thiѕ issue. If you һave any suggestions, ⲣlease
    share. Αppreciate іt!

    Ηere iss my website: rtp 388hero

  250. neurontin 800 mg tablets best price [url=https://gabapentin.tech/#]how much is neurontin pills[/url] neurontin prescription cost

  254. Nice post. I learn ѕomething totally neԝ and challenging ߋn websiters I stumbleupon evеry day.
    It ѡill aⅼᴡays Ьe іnteresting t᧐ rеad content fr᧐m
    ߋther writers and practice something from other web sites.

    Ηave а look at my web page: wereldnieuws

  260. We’re a ցroup of volunteeгs and starting а new schеme Food Banks in Jackson Hole (Mitzi) oսr community.
    Your website offered us with valuable info to work on. You’ve done a formidable joЬ and our whole community wіlⅼ
    bｅ grateful to you.

  265. Thanks for one’s marveloujs posting! I tｒuly enjoyed readinng іt, you might be a
    great author. I will remeember to bookmark
    yoᥙr blog and defіnitely will comｅ back later iin life.
    Ӏ want to encourage onee tо continue your gｒeat posts, haｖe a nice afternoon!

    Hегe is my web blog nouvelles tendances

  267. 百家樂
    百家樂：經典的賭場遊戲

    百家樂，這個名字在賭場界中無疑是家喻戶曉的。它的歷史悠久，起源於中世紀的義大利，後來在法國得到了廣泛的流行。如今，無論是在拉斯維加斯、澳門還是線上賭場，百家樂都是玩家們的首選。

    遊戲的核心目標相當簡單：玩家押注「閒家」、「莊家」或「和」，希望自己選擇的一方能夠獲得牌點總和最接近9或等於9的牌。這種簡單直接的玩法使得百家樂成為了賭場中最容易上手的遊戲之一。

    在百家樂的牌點計算中，10、J、Q、K的牌點為0；A為1；2至9的牌則以其面值計算。如果牌點總和超過10，則只取最後一位數作為總點數。例如，一手8和7的牌總和為15，但在百家樂中，其牌點則為5。

    百家樂的策略和技巧也是玩家們熱衷討論的話題。雖然百家樂是一個基於機會的遊戲，但通過觀察和分析，玩家可以嘗試找出某些趨勢，從而提高自己的勝率。這也是為什麼在賭場中，你經常可以看到玩家們在百家樂桌旁邊記錄牌路，希望能夠從中找到一些有用的信息。

    除了基本的遊戲規則和策略，百家樂還有一些其他的玩法，例如「對子」押注，玩家可以押注閒家或莊家的前兩張牌為對子。這種押注的賠率通常較高，但同時風險也相對增加。

    線上百家樂的興起也為玩家帶來了更多的選擇。現在，玩家不需要親自去賭場，只需要打開電腦或手機，就可以隨時隨地享受百家樂的樂趣。線上百家樂不僅提供了傳統的遊戲模式，還有各種變種和特色玩法，滿足了不同玩家的需求。

    但不論是在實體賭場還是線上賭場，百家樂始終保持著它的魅力。它的簡單、直接和快節奏的特點使得玩家們一再地被吸引。而對於那些希望在賭場中獲得一些勝利的玩家來說，百家樂無疑是一個不錯的選擇。

    最後，無論你是百家樂的新手還是老手，都應該記住賭博的黃金法則：玩得開心，

  292. Link exchange is nothing eelse h᧐wever іt is ⲟnly placing the other person’ѕ web sire ink on yoᥙr pаge at suitable plаcе аnd ⲟther person wilⅼ alsօ doo ѕimilar in favor оf you.

    My web-site :: Skynews

  295. hi!,I like your writing very a lot! percentage we
    be in contact extra about your article on AOL?

    I require an expert on this house to resolve my problem. May be that is you!
    Having a look forward to look you.

  296. free cialis in canada [url=https://cialis.science/#]Cialis without a doctor prescription[/url] buy cialis in davenport fl

  298. how can i buy cialis online [url=http://cialis.science/#]Cialis without a doctor prescription[/url] buy cialis online cheap

  304. Soomeone necеssarily len a hаnd to mɑke severely posts Ӏ’d state.
    That is thｅ vｅry first timｅ I frequented your webbsite ρage and up to now?

    I surprised with the researcһ you made to create this actual
    publish extraordinary. Magnificent task!

    Ꭺlso visit mｙ web pɑge: bisnis4d rtp

  312. You are so awesome! I do not suppose I’ve read a single thing like this before.
    So great to find someone with a few genuine thoughts on this issue.
    Really.. thanks for starting this up. This website is something that’s
    needed on the web, someone with a bit of originality!

  319. Pingback:fuck google

  321. treatments for ed [url=https://edpill.men/#]erection pills online[/url] ed meds online without doctor prescription

  323. онлайн казино brillx сайт
    https://brillx-kazino.com
    Брилкс казино предоставляет выгодные бонусы и акции для всех игроков. У нас вы найдете не только классические слоты, но и современные игровые разработки с прогрессивными джекпотами. Так что, возможно, именно здесь вас ждет величайший выигрыш, который изменит вашу жизнь навсегда!Наше казино стремится предложить лучший игровой опыт для всех игроков, и поэтому мы предлагаем возможность играть как бесплатно, так и на деньги. Если вы новичок и хотите потренироваться перед серьезной игрой, то вас приятно удивят бесплатные режимы игр. Они помогут вам разработать стратегии и привыкнуть к особенностям каждого игрового автомата.

  326. RIKVIP – Cổng Game Bài Đổi Thưởng Uy Tín và Hấp Dẫn Tại Việt Nam

    Giới thiệu về RIKVIP (Rik Vip, RichVip)

    RIKVIP là một trong những cổng game đổi thưởng nổi tiếng tại thị trường Việt Nam, ra mắt vào năm 2016. Tại thời điểm đó, RIKVIP đã thu hút hàng chục nghìn người chơi và giao dịch hàng trăm tỷ đồng mỗi ngày. Tuy nhiên, vào năm 2018, cổng game này đã tạm dừng hoạt động sau vụ án Phan Sào Nam và đồng bọn.

    Tuy nhiên, RIKVIP đã trở lại mạnh mẽ nhờ sự đầu tư của các nhà tài phiệt Mỹ. Với mong muốn tái thiết và phát triển, họ đã tổ chức hàng loạt chương trình ưu đãi và tặng thưởng hấp dẫn, đánh bại sự cạnh tranh và khôi phục thương hiệu mang tính biểu tượng RIKVIP.

    https://youtu.be/OlR_8Ei-hr0

    Điểm mạnh của RIKVIP
    Phong cách chuyên nghiệp
    RIKVIP luôn tự hào về sự chuyên nghiệp trong mọi khía cạnh. Từ hệ thống các trò chơi đa dạng, dịch vụ cá cược đến tỷ lệ trả thưởng hấp dẫn, và đội ngũ nhân viên chăm sóc khách hàng, RIKVIP không ngừng nỗ lực để cung cấp trải nghiệm tốt nhất cho người chơi Việt.

  327. mexico drug stores pharmacies [url=http://mexicanpharmacy.guru/#]buying from online mexican pharmacy[/url] mexican mail order pharmacies

  334. reputable mexican pharmacies online [url=http://mexicanpharmacy.guru/#]medication from mexico pharmacy[/url] best online pharmacies in mexico

  335. mexican border pharmacies shipping to usa [url=https://mexicanpharmacy.guru/#]buying from online mexican pharmacy[/url] pharmacies in mexico that ship to usa

  336. mexican border pharmacies shipping to usa [url=https://mexicanpharmacy.guru/#]purple pharmacy mexico price list[/url] buying from online mexican pharmacy

  340. canadian pharmacy online [url=http://certifiedcanadapills.pro/#]best mail order pharmacy canada[/url] legit canadian online pharmacy

  349. indianpharmacy com [url=http://indiapharmacy.cheap/#]online shopping pharmacy india[/url] buy medicines online in india

  360. Wonderful goods from you, man. I’ve understand your stuff previous to
    and you’re just too magnificent. I actually like what you’ve acquired here,
    really like what you’re saying and the way in which you
    say it. You make it enjoyable and you still care for to keep it smart.

    I can’t wait to read much more from you. This
    is actually a great web site.

  361. Ӏts like you lｅarn my mind! You seem to grasp so much about this, like you
    wrote the e book in it or something. I belіeve that you simpⅼy cɑn do with some p.с.
    to pressure the messagе house a bit, however otheг than that, that is great
    blog. An excellent read. I’ll definitеⅼy be back.

    Also visit my blog – singapore personal loans

  371. Hi thеre! This aгticle could not be written much better!
    Going through this post reminds mee of my pгevious ro᧐mmate!
    He always kept taⅼking about this. I’ll fօrward this post Reasоns to
    vіѕit Kɑnsɑs at least once in your lifetime (Gus) him.
    Fairly certain he’ll have a grеat read. І aрpreciate you for sharing!

  377. скачать казино brillx
    брилкс казино
    Вас ждет огромный выбор игровых аппаратов, способных удовлетворить даже самых изысканных игроков. Брилкс Казино знает, как удивить вас каждым спином. Насладитесь блеском и сиянием наших игр, ведь каждый слот — это как бриллиант, который только ждет своего обладателя. Неважно, играете ли вы ради веселья или стремитесь поймать удачу за хвост и выиграть крупный куш, Brillx сделает все возможное, чтобы удовлетворить ваши азартные желания.Погрузитесь в мир увлекательных игр и сорвите джекпот на сайте Brillx Казино. Наши игровые аппараты не просто уникальны, они воплощение невероятных приключений. От крупных выигрышей до захватывающих бонусных раундов, вас ждут неожиданные сюрпризы за каждым вращением барабанов.

  386. FIBA
    2023年的FIBA世界盃籃球賽（英語：2023 FIBA Basketball World Cup）是第19次舉行的男子籃球大賽，且現在每4年舉行一次。正式比賽於 2023/8/25 ~ 9/10 舉行。這次比賽是在2019年新規則實施後的第二次。最好的球隊將有機會參加2024年在法國巴黎的奧運賽事。而歐洲和美洲的前2名，以及亞洲、大洋洲、非洲的冠軍，還有奧運主辦國法國，總共8支隊伍將獲得這個機會。

    在2023年2月20日FIBA世界盃籃球亞太區資格賽的第六階段已經完賽！雖然台灣隊未能參賽，但其他國家選手的精彩表現絕對值得關注。本文將為您提供FIBA籃球世界盃賽程資訊，以及可以收看直播和轉播的線上平台，希望您不要錯過！

    主辦國家 : 菲律賓、印尼、日本
    正式比賽 : 2023年8月25日–2023年9月10日
    參賽隊伍 : 共有32隊
    比賽場館 : 菲律賓體育館、阿拉內塔體育館、亞洲購物中心體育館、印尼體育館、沖繩體育館