Top 10 winner

Attacking OData: HTTP Verb Tunneling, Navigation Properties for Additional Data Access, System Query Options ($select)

Gursev Singh Kalra · McAfee Foundstone Professional Services

A penetration tester’s guide to OData service documents, metadata and RESTful operations. It recommends testing X-HTTP-Method verb tunneling, navigation properties and $select=* for inconsistent access controls, and demonstrates detailed error disclosure through unsupported $format values.

Record

Researcher

Gursev Singh Kalra

Published by

McAfee Foundstone Professional Services

Format

Whitepaper

In the archive

• Ranked #10 in the 2012 Top 10 Web Hacking Techniques

Tags

• rest-api
• http
• auth-bypass
• info-leak
• idor
• dotnet
• tooling
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Gursev Singh Kalra, first published at the original source. Preserved copies are kept so the citation survives its host.