 |
The second method is Detecting vulnerable endpoints by replacing variables.
The second method estimate the endpoints that are not described in the reference by substituting variables that take any value in the endpoint.
For example, if an endpoint has a variable that takes an arbitrary value, such as {id} in /wp/v2/posts/{id}, vulnerability assessment is conducted by changing the value of this {id}.
Therefore, we need to get the value of the ID being used.
The ID values are obtained from the content of the response to a request sent to /wp/v2/posts, one level above wp/v2/posts/{id}.
For example, if numbers such as 38 and 1 are used as IDs, the maximum value +1, the minimum value -1, and the median value of these numbers are calculated and substituted into the ID value. These values are substituted into the ID value and the request is sent.
The vulnerability is determined from the status code in the response. |
IEEE/ICACT20220047 Slide.12
[Big Slide]