https://blog.mingon.dev/tags/information-disclosure/Recent content in Information Disclosure on 보안 연구 노트Hugo -- gohugo.ioko-KRFri, 03 Jul 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-password-disclosure/Fri, 03 Jul 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-password-disclosure/비밀번호가 input value에 미리 채워지는 계정 페이지를 IDOR로 열어 관리자 비밀번호를 탈취하는 풀이https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-data-leakage-in-redirect/Fri, 03 Jul 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-data-leakage-in-redirect/리다이렉트 응답이 함께 실어 보내는 본문에서 다른 사용자의 API Key가 유출되는 IDOR 풀이https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-unpredictable-user-ids/Fri, 03 Jul 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---user-id-controlled-by-request-parameter-with-unpredictable-user-ids/GUID로 사용자를 식별하는 IDOR에서, 블로그 작성자 링크에 노출된 대상의 GUID를 수집해 API Key를 탈취하는 풀이https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---unprotected-admin-functionality-with-unpredictable-url/Thu, 02 Jul 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/access-control/write-up-portswigger---unprotected-admin-functionality-with-unpredictable-url/예측 불가능한 관리자 패널 경로를 클라이언트 자바스크립트 소스에서 찾아내 접근하는 Access Control 풀이