Blind Oracle Extracting Restricted Data Through a Search API

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://kymu.dev/article/BlindOracle
• Blog Title: Blind Oracle: Extracting Restricted Data Through a Search API
• Suggested Section: Pentesting Web / IDOR or a new subsection named "Search-Index Authorization Bypass and Blind Search Oracles"

🎯 Content Summary

Overview

The post, published in August 2026, describes the discovery and exploitation of a blind search oracle in a cloud-based design-collaboration platform with granular role-based access controls. The researcher configured two accounts: an administrator and a deliberately restricted user. The administrator removed the second account's access to the Notes tab and disabled visibility of metadata such as creator email addresses. Although the restricted user could no...

🔧 Technical Details

Search-index authorization bypass: When an application hides sensitive fields in its UI or API responses but leaves them in a full-text index, unauthorized users may still infer their contents. Restrict the search to an accessible object using workspace and object identifiers, then submit candidate terms. If the object appears only when the candidate is present, the search subsystem is evaluating fields that the caller cannot directly read. Authorization must be applied before query evaluation rather than only when results are serialized.

Response-based blind substring oracle: A reliable difference between matching and nonmatching searches can leak one bit per request. The demonstrated endpoint returned HTTP 200 with the scoped item for a matching substring and HTTP 204 for a nonmatch. Equivalent signals can be exposed through result counts, body lengths, errors, status codes, or timing differences. Validate the ...

🤖 Agent Actions

Plan:

1. Map relevant web/authorization/search documentation and inspect at least five candidate pages.
2. Compare the blog’s oracle technique against existing coverage and select one best-fit file.
3. Add concise, cited technical guidance only if non-duplicative.
4. Review the diff, validate reference placement/Markdown, and check repository status.
   Repository mapping is complete. I’m now comparing the IDOR, API-testing, XS-Leak, SQL-oracle, Elasticsearch, and general web-methodology pages to avoid duplicating an existing oracle pattern and to keep the addition in one file.
   The best fit is the existing src/pentesting-web/idor.md: the defect is an authorization failure on a known object, while the search response supplies the oracle. The XS-Search page is cross-origin/browser-side, and the Elasticsearch page is service enumeration, so placing the technique there would be misleading. I’m doing a final duplication/status check before editing only the IDOR page.
   Editing has started. I’ll add one compact subsection under the existing oracle material, including object scoping, signal calibration, bidirectional extraction with ambiguity handling, and permission-aware indexing/detection; the original blog will be appended as reference [8].
   The documentation change is in place. I’m verifying the exact diff, citation numbering, code-block length, forbidden-source absence, and Markdown whitespace; I’ll correct anything found before finishing.
   The review found only a minor emphasis-formatting issue, now corrected. I’m running the final repository checks and attempting the project’s documented mdBook validation if the binary is available.
   Updated src/pentesting-web/idor.md with:

• Search-index field-level authorization bypass testing.
• Object-scoped blind substring oracle identification.
• Bidirectional secret reconstruction and ambiguity handling.
• Technical remediation and detection guidance.
• Numbered citation to the supplied original research.

Validation passed with git diff --check and content assertions. mdbook was unavailable, so the full build was skipped.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://kymu.dev/article/BlindOracle

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web / IDOR or a new subsection named "Search-Index Authorization Bypass and Blind Search Oracles"".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0