PortSwigger Lab Shows How a Sequential File Name Exposes User Data via IDOR

·3 views

A PortSwigger Web Security Academy lab demonstrated an Insecure Direct Object Reference (IDOR) vulnerability through a support chat transcript download feature. The system assigned sequential file names — such as 2.txt — to user transcripts and served them via static URLs with no session-based ownership verification. By simply requesting 1.txt instead of 2.txt, the researcher accessed another user's transcript containing a plaintext password. The lab illustrates that IDOR occurs specifically when a server exposes a direct resource reference to the client and trusts it without validating who is making the request. Recommended fixes include mapping files to sessions server-side rather than exposing raw identifiers, and always enforcing ownership checks regardless of whether the identifier appears hard to guess.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developers Use Multiple AI Tools to Cross-Check and Improve Generated Code

Software developers are increasingly using more than one AI coding assistant to review and refine AI-generated code. One developer noted that GitHub Copilot was catching meaningful issues in code originally produced by GPT-4o at high settings. This cross-review approach, sometimes called a 'rinse cycle,' involves running generated code through a second AI to catch errors the first may have missed. The practice highlights growing awareness that no single AI tool produces flawless output. Developers are exploring how iterative multi-AI review can improve code quality and reliability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OSI Model Demystified: How Seven Layers Power Network Communication

The OSI (Open Systems Interconnection) model is a seven-layer conceptual framework that breaks down network communication into distinct responsibilities, making complex networking concepts easier to understand. The lower four layers — Physical, Data Link, Network, and Transport — are especially foundational, directly relating to hardware like cables, switches, and routers. Layer 1 handles the physical transmission of binary data through mediums such as Ethernet cables, fiber, and Wi-Fi, while Layer 2 manages hop-to-hop communication between directly connected devices using MAC addresses. Layer 3 takes a broader view, using IP addresses to route data across multiple networks from a source all the way to its final destination. Understanding each layer's role helps clarify how related concepts like TCP/UDP, encapsulation, and addressing fit together in real-world cloud and DevOps environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Bluesky Watermarks Screenshots With Its Logo to Boost Brand Identity

Bluesky automatically embeds its logo as a watermark on screenshots taken within the app, a technical detail documented by developer Tim Marrinin that gained significant traction on Hacker News with 247 points and 182 comments. The watermark is rendered as an SVG overlay composited onto the screenshot bitmap at capture time, ensuring consistent scaling across iOS, Android, and web platforms. Platforms like TikTok and Instagram have adopted similar practices to maintain brand visibility as content spreads across the internet. Bluesky's approach drew mixed reactions, with supporters arguing it aids content attribution and anti-misinformation efforts, while critics contend it amounts to forced advertising that infringes on user ownership of their screenshots. Notably, Bluesky published the technical implementation details publicly, which is uncommon among platforms that typically treat watermarking as an undisclosed internal process.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer runs Whisper speech-to-text locally to keep sensitive work call audio private

A developer building a work call transcription tool has chosen to run OpenAI's Whisper model locally rather than use cloud APIs, citing privacy concerns over sensitive client and pricing discussions. The setup runs faster-whisper in int8 quantized mode on an RTX 3060 GPU with 12 GB of VRAM, shared with two other AI models on the same server. To manage limited VRAM, the three models run sequentially, and Whisper falls back to CPU processing when GPU pressure is high, slowing transcription from roughly 8–12 seconds to 30–60 seconds per audio minute. Transcription accuracy exceeds 90% on clean audio but degrades noticeably with background noise, speakerphones, or domain-specific terminology. The developer acknowledges that cloud-hosted Whisper endpoints are faster and easier to manage, but argues the tradeoff favors local processing when the audio content itself is confidential.

0 comments Read more at DEV Community