# Insecure direct object references

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FVhCNDzXyYUt6SNEg1GJT%2F1.png?alt=media&#x26;token=622bdf79-960a-42d0-a293-30637b7f4fc8" alt=""><figcaption></figcaption></figure>

Let's start the live chat.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FEDf2VmAwKGlbrRVcXPz1%2F2.png?alt=media&#x26;token=0259449f-f412-48e3-98e9-c9dae8d847d5" alt=""><figcaption></figcaption></figure>

We can now download this chat by clicking on the `View transcript` button. Since we are proxying the traffic through Burp Suite, we will be able to see the request in the `Proxy > HTTP History`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Fqmh56u8s0SeF9I7YDEKC%2F2.2.png?alt=media&#x26;token=83e8327c-57e1-48d1-9fc3-e43946f465f1" alt=""><figcaption></figcaption></figure>

We are being redirected, let's view the next request.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FBVGD9WJbSqTZsocFfb5q%2F3.png?alt=media&#x26;token=c1d3b3e7-5161-4173-83e6-7e74a8bbdc3f" alt=""><figcaption></figcaption></figure>

As we can see, our entire chat log is saved. Let's forward this request to the `Repeater` for further modification. Once in the `Repeater`, change the GET URI to the following:

```
/download-tanscript/2.txt
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F2rd4mYqkVacq5OxCEVOS%2F4.png?alt=media&#x26;token=30a69dc0-1830-454a-aff2-562e6fd9a6cb" alt=""><figcaption></figcaption></figure>

This causes the application to give the transcripts of another user's chat. We can now try to login to the `carlos` user's account using the following credentials:

| Username | Password             |
| -------- | -------------------- |
| carlos   | z7yiqtqjuttawu19dlxw |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FBgZtWi27jooKNX0qf4no%2F5.png?alt=media&#x26;token=2ced3b5d-239c-4ff3-8656-b8c03f0edcd6" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FQJsOagqwiC4LD3gWuZbv%2F6.png?alt=media&#x26;token=f8d68db8-ab37-4ec7-b1b5-306e18753256" alt=""><figcaption></figcaption></figure>
