Blind Oracle Extracting Restricted Data Through a Search API

src/pentesting-web/idor.md

@@ -93,6 +93,46 @@ ffuf -u 'http://target/view.php?username=FUZZ&file=test.doc' \
 
 Once valid usernames are identified, request specific files directly (e.g., `/view.php?username=amanda&file=privacy.odt`). This pattern commonly leads to unauthorized disclosure of other users’ documents and credential leakage.
 
+---
+
+### Search-index authorization bypass and blind substring oracle
+
+Search, autocomplete, filtering, and analytics are often backed by a secondary index. If an application removes a restricted field only while rendering or serializing a result, but still lets that field participate in search evaluation, a low-privileged user can infer its contents. Constrain the query to one object the user can access so that the object's presence becomes a membership test for attacker-controlled text in any of its indexed fields.<sup>[[8]](#references)</sup>
+
+A practical test is to compare an administrator with a deliberately restricted account, select an object whose hidden field is known from the administrator session, and combine a candidate term with the narrowest available tenant/workspace and object filters. For example, a Lucene-style endpoint might accept a query shaped like this:<sup>[[8]](#references)</sup>
+
+```http
+GET /api/search?query={candidate}%20AND%20((workspaceId=1%20AND%20ITEM_DETAILS:ITEM_ID=23)) HTTP/2
+Cookie: session={low_privilege_session}
+```
+
+Calibrate the oracle with known-positive and known-negative terms. A scoped item in a `200` response versus no item in a `204` response is a particularly clean signal, but result counts, body length, errors, or stable timing differences can provide the same Boolean primitive. Keep the object filter fixed: otherwise unrelated documents can produce false positives.<sup>[[8]](#references)</sup>
+
+#### Bidirectional extraction
+
+A substring oracle does **not** identify position zero: every character occurring anywhere in the hidden value tests positive. Start from a distinctive matching marker (for example `@` for an email or `://` for a URL), prepend each character from the expected alphabet until no extension matches, then append characters until reaching the other boundary. The core state transition can be represented as follows:<sup>[[8]](#references)</sup>
+
+```python
+def extend(seed, left):
+    while True:
+        hits = []
+        for char in alphabet:
+            trial = char + seed if left else seed + char
+            if oracle(trial):
+                hits.append(trial)
+        if not hits:
+            return seed
+        if len(hits) > 1:
+            return backtrack(hits, left)
+        seed = hits[0]
+
+value = extend(extend(seed, left=True), left=False)
+```
+
+Do not blindly keep the first successful extension. Multiple hidden fields, repeated substrings, or several values containing the seed can create multiple valid branches; retain them and backtrack or validate candidates using additional contextual markers. Also derive the alphabet from the data type and test how the search analyzer handles case, punctuation, token boundaries, escaping, wildcards, and reserved query characters.<sup>[[8]](#references)</sup>
+
+The fix is to apply **object- and field-level authorization before query evaluation**: build permission-aware index documents or restrict the queried fields to those visible to the principal, validate tenant/object filters, and rebuild indexes after removing sensitive fields. For detection, alert on a fixed object filter accompanied by many overlapping one-character query extensions and rate-limit that pattern; normalizing `200`/`204` responses only obscures the signal and does not repair the authorization failure.<sup>[[8]](#references)</sup>
+
 ---
 ## 2. Real-World Case Study – McHire Chatbot Platform (2025)
 
@@ -174,5 +214,6 @@ for band_id in ["C-285-100", "T-544-492"]:
 - [5] [0xdf – HTB Era: predictable download IDs → backups and signing keys](https://0xdf.gitlab.io/2025/11/29/htb-era.html)
 - [6] [0xdf – HTB: Guardian](https://0xdf.gitlab.io/2026/02/28/htb-guardian.html)
 - [7] [Carlsberg memories wristband IDOR – predictable QR IDs + Intruder brute force (2026)](https://www.pentestpartners.com/security-blog/carlsberg-probably-not-the-best-cybersecurity-in-the-world/)
+- [8] [Blind Oracle: Extracting Restricted Data Through a Search API](https://kymu.dev/article/BlindOracle)
 
 {{#include ../banners/hacktricks-training.md}}