This is a demo lab about a recent critical bug i found that resulted in ATO
The ATO was as a result of:
- Idor in Email Change and Verification Endpoints
- No ACL in Email Change
- No ACL in Email Change Verification
- SMTP (GMAIL) creds [https://mailmeteor.com/blog/gmail-smtp-settings]
- JWT Secret (just random values e.g cat walking on keyboard)
- MongoDB database (get on here https://www.mongodb.com/)
- nodejs installed locally (if you don't wanna use docker)
- clone this repo
git clone https://github.com/crypt0g30rgy/Idor-ATO.git- cd into directory
cd Idor-ATO- run npm install
npm i- run npm dev server
npm run dev// Testing