1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
| #!/usr/bin/env python3
"""
IDOR Vulnerability Scanner
用於自動化測試 IDOR 漏洞的 Python 腳本
"""
import requests
import argparse
import json
from concurrent.futures import ThreadPoolExecutor, as_completed
from urllib.parse import urlparse, urljoin
import re
class IDORScanner:
def __init__(self, base_url, auth_header, timeout=10):
self.base_url = base_url
self.session = requests.Session()
self.session.headers.update(auth_header)
self.timeout = timeout
self.results = []
def test_numeric_idor(self, endpoint_pattern, id_range, original_id):
"""
測試數字型 IDOR
endpoint_pattern: /api/users/{id}/profile
id_range: (1000, 1100)
original_id: 當前使用者的 ID
"""
vulnerable_ids = []
for test_id in range(id_range[0], id_range[1] + 1):
if test_id == original_id:
continue
url = endpoint_pattern.replace('{id}', str(test_id))
full_url = urljoin(self.base_url, url)
try:
response = self.session.get(full_url, timeout=self.timeout)
if response.status_code == 200:
vulnerable_ids.append({
'id': test_id,
'url': full_url,
'status_code': response.status_code,
'response_length': len(response.content),
'response_preview': response.text[:200]
})
print(f"[VULN] Potential IDOR: {full_url}")
except requests.RequestException as e:
print(f"[ERROR] Request failed for {full_url}: {e}")
return vulnerable_ids
def test_uuid_idor(self, endpoint_pattern, uuid_list, original_uuid):
"""
測試 UUID 型 IDOR
"""
vulnerable_uuids = []
for test_uuid in uuid_list:
if test_uuid == original_uuid:
continue
url = endpoint_pattern.replace('{uuid}', test_uuid)
full_url = urljoin(self.base_url, url)
try:
response = self.session.get(full_url, timeout=self.timeout)
if response.status_code == 200:
vulnerable_uuids.append({
'uuid': test_uuid,
'url': full_url,
'status_code': response.status_code
})
print(f"[VULN] Potential IDOR: {full_url}")
except requests.RequestException as e:
print(f"[ERROR] Request failed: {e}")
return vulnerable_uuids
def test_parameter_tampering(self, url, params, param_to_test, test_values):
"""
測試參數竄改型 IDOR
"""
original_value = params.get(param_to_test)
vulnerable_params = []
for test_value in test_values:
if test_value == original_value:
continue
test_params = params.copy()
test_params[param_to_test] = test_value
full_url = urljoin(self.base_url, url)
try:
response = self.session.get(
full_url,
params=test_params,
timeout=self.timeout
)
if response.status_code == 200:
vulnerable_params.append({
'param': param_to_test,
'value': test_value,
'url': response.url
})
print(f"[VULN] Parameter tampering: {param_to_test}={test_value}")
except requests.RequestException as e:
print(f"[ERROR] Request failed: {e}")
return vulnerable_params
def parallel_test(self, endpoint_pattern, id_list, original_id, workers=10):
"""
平行測試多個 ID
"""
results = []
with ThreadPoolExecutor(max_workers=workers) as executor:
futures = {}
for test_id in id_list:
if test_id == original_id:
continue
url = endpoint_pattern.replace('{id}', str(test_id))
full_url = urljoin(self.base_url, url)
future = executor.submit(
self.session.get,
full_url,
timeout=self.timeout
)
futures[future] = test_id
for future in as_completed(futures):
test_id = futures[future]
try:
response = future.result()
if response.status_code == 200:
results.append({
'id': test_id,
'url': response.url,
'status': 'VULNERABLE'
})
print(f"[VULN] ID {test_id} accessible")
except Exception as e:
print(f"[ERROR] ID {test_id}: {e}")
return results
def generate_report(self, output_file='idor_report.json'):
"""
產生測試報告
"""
report = {
'target': self.base_url,
'total_vulnerabilities': len(self.results),
'findings': self.results
}
with open(output_file, 'w') as f:
json.dump(report, f, indent=2)
print(f"\n[INFO] Report saved to {output_file}")
return report
def main():
parser = argparse.ArgumentParser(description='IDOR Vulnerability Scanner')
parser.add_argument('-u', '--url', required=True, help='Base URL')
parser.add_argument('-e', '--endpoint', required=True,
help='Endpoint pattern (e.g., /api/users/{id}/profile)')
parser.add_argument('-t', '--token', required=True, help='Authorization token')
parser.add_argument('-r', '--range', default='1-100',
help='ID range to test (e.g., 1-100)')
parser.add_argument('-o', '--original-id', type=int, required=True,
help='Your original user ID')
parser.add_argument('-w', '--workers', type=int, default=10,
help='Number of parallel workers')
parser.add_argument('--output', default='idor_report.json',
help='Output report file')
args = parser.parse_args()
# 解析 ID 範圍
id_start, id_end = map(int, args.range.split('-'))
id_list = list(range(id_start, id_end + 1))
# 初始化掃描器
auth_header = {'Authorization': f'Bearer {args.token}'}
scanner = IDORScanner(args.url, auth_header)
print(f"[INFO] Starting IDOR scan on {args.url}")
print(f"[INFO] Testing endpoint: {args.endpoint}")
print(f"[INFO] ID range: {id_start} - {id_end}")
# 執行掃描
results = scanner.parallel_test(
args.endpoint,
id_list,
args.original_id,
args.workers
)
scanner.results = results
scanner.generate_report(args.output)
print(f"\n[INFO] Scan complete. Found {len(results)} potential vulnerabilities.")
if __name__ == '__main__':
main()
|