Web App Privilege Escalation by 21y4d | Hack The Box hacking workshop

The video demonstrates how IDOR vulnerabilities can be exploited for privilege escalation in web applications through API manipulation 3:41.

Key Takeaways:
• Privilege escalation isn't limited to OS - any application with user access control is vulnerable 3:41
• IDOR vulnerability allows accessing other users' data by modifying UID parameters in API requests 7:50
• Initial attempts to change roles or create users fail due to authorization checks 9:38
• Combining information disclosure with UUID values enables modifying other users' profiles 16:08
• Fuzzing user IDs reveals an admin role ("staff admin") that can be used for privilege escalation 18:00

The presenter emphasizes this isn't just theoretical - a recent Instagram vulnerability with the same flaw earned a $50,000 bounty 22:17.

Sources:

• 3:41 Explaining privilege escalation beyond OS
• 7:50 Demonstrating IDOR vulnerability
• 9:38 Failed privilege escalation attempts
• 16:08 Combining vulnerabilities
• 18:00 Successful privilege escalation
• 22:17 Real-world Instagram example