SOC169 — Possible IDOR Attack Detected

SOC169 — Possible IDOR Attack Detected

Event ID: 119
Platform: LetsDefend

Alert

EventID : 119
Event Time : Feb, 28, 2022, 10:48 PM
Rule : SOC169 - Possible IDOR Attack Detected
Level : Security Analyst
Hostname : WebServer1005
Destination IP Address : 172.16.17.15
Source IP Address : 134.209.118.137
HTTP Request Method : POST
Requested URL : https://172.16.17.15/get_user_info/
User-Agent : Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Alert Trigger Reason : consecutive requests to the same page …

blue team cybersecurity idor vulnerability incident response letsdefendio