🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.pentestpartners.com/security-blog/carlsberg-probably-not-the-best-cybersecurity-in-the-world/
• Blog Title: Carlsberg… probably not the best cybersecurity in the world
• Suggested Section: 🕸️ Pentesting Web → IDOR (and/or Rate Limit Bypass / Authorization issues) — add a subsection on 'Weak bearer identifiers / enumerable IDs in QR/URLs (encoding ≠ security) + Burp Intruder enumeration + validating rate limiting'

🎯 Content Summary

The post documents an unauthenticated IDOR / weak bearer-token design in the “Home of Carlsberg” exhibition “memories” feature, where knowing/guessing a wristband ID is sufficient to retrieve other visitors’ photos/videos and associated PII (full names).

1) How the system works (data flow)
1. Visitors receive wristbands with a QR code during the Copenhagen exhibition (Aug 2025). Interactive kiosks (beer blend, “dance in a beer ...

🔧 Technical Details

Weak bearer identifier / IDOR via enumeratable IDs: If a web application uses a short/guessable identifier in a URL/QR code as the only “authentication” to retrieve private objects (photos/videos/PII), it becomes an IDOR/weak-token issue: an attacker can enumerate candidate IDs until responses indicate a valid object, then retrieve other users’ content. Simple transformations (e.g., ASCII-to-hex encoding) do not add security because they are reversible and do not increase entropy.

Practical online keyspace enumeration with Burp Intruder: Use Burp Suite’s Intruder to automate requests over an ID/keyspace, then identify valid IDs by filtering on response characteristics (e.g., presence of media links vs. invalid/empty responses). Measuring throughput (IDs tested per hour) allows estimating feasibility/time to cover the keyspace and the likely scale of exposed users/content.

Validating rate limiting claims: When a vendor claims “rate limiting” as a miti...

🤖 Agent Actions

Summary:

• Updated IDOR page with a new case study on QR-coded wristband IDs acting as weak bearer tokens (ASCII→hex encoding) and how to enumerate them.
• Added Burp Intruder workflow for generating/hex-encoding candidate IDs, response grepping, throughput estimation, and verifying ineffective rate limiting.
• Included quick Python example for client-side hex encoding and retrieval plus lessons learned about entropy and authorization.

Tests:

• Not run (documentation-only changes).

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.