WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Oct 12, 2020

How to Cause (or Prevent) a Massive Data Breach- Secure Coding and IDOR

Anna Bacher

Could a simple URL tweak expose your database? IDOR vulnerabilities routinely cause massive enterprise data breaches. Learn to systematically eradicate these flaws using AI-driven secure coding.

Pause
Mute Enter Fullscreen
#1 about 4 min

Introduction to insecure direct object reference vulnerabilities

How software vulnerabilities like IDOR enable massive data breaches by breaking access controls.

#2 about 3 min

Real-world business consequences of IDOR vulnerabilities

Why IDOR exploitation causes severe business consequences like account takeovers and heavy financial penalties.

#3 about 2 min

Mechanisms of exploiting IDOR through URL manipulation

How attackers gain unauthorized access to sensitive documents by simply incrementing ID numbers in web requests.

#4 about 4 min

Setting up a penetration testing environment for web apps

To safely demonstrate web application vulnerabilities, developers can prepare an environment using Kali Linux and Burp Suite.

#5 about 5 min

Exploiting e-commerce basket identifiers with Burp Suite

Attackers can intercept and manipulate API requests using Burp Suite to access other users' shopping baskets without authorization.

#6 about 7 min

Modifying user product reviews via IDOR vulnerability exploitation

Modifying user identifiers in intercepted HTTP requests allows attackers to impersonate users and alter product reviews.

#7 about 3 min

Reviewing high-profile IDOR vulnerabilities found on HackerOne

Analyzing real IDOR exploits in major platforms reveals how simple API oversight leads to massive account takeovers.

#8 about 2 min

Challenges of systematically defending enterprise code against IDOR

Because traditional mitigation strategies rely heavily on manual access controls, they often fail to protect enterprise codebases.

#9 about 7 min

Detecting complex IDOR vulnerabilities using code property graphs

Analyzing source code through multi-graph structures helps developers identify complex IDOR patterns with fewer false positives.

#10 about 3 min

Limitations of CodeQL for accurate IDOR vulnerability detection

Standard semantic query tools often miss critical vulnerabilities by relying too heavily on rigid variable naming conventions.

#11 about 5 min

Improving detection and automated patching with neural networks

Training neural networks on code property graphs empowers developers to automatically detect vulnerabilities and generate authorization patches.

Matching moments

5:30 min

Identifying non-coding software vulnerabilities and organizational risks

Tino Sokic · World Congress 2023

2:55 min

Identifying common and emerging application injection attack vectors

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

3:06 min

Transitioning from code risks to data-driven business threats

Jon Geater · World Congress 2023

1:08 min

Mitigating AI code risks and OWASP recommendations

Liran Tal Liran Tal · LIVE

3:02 min

Uncovering hidden vulnerabilities and bloat in web ecosystems

Chris Heilmann Chris Heilmann +2 · LIVE

2:10 min

Examining common exploitation techniques against software organizations

Vandana Verma · LIVE

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
10 days ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
17 days ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
19 days ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
24 days ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
26 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
about 1 month ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

Related videos

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 7 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Can Machines Dream of Secure Code? Emerging AI Security Risks in LLM-driven Developer Tools thumbnail
35:37
LIVE • about 2 years ago

Can Machines Dream of Secure Code? Emerging AI Security Risks in LLM-driven Developer Tools

Liran Tal

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most thumbnail
24:33
World Congress 2026 Europe • 3 months ago

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • over 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks thumbnail
27:10
World Congress 2023 • almost 3 years ago

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.