Posts on idor
7 posts on idor. Notes from public sources and my own test lab.
The Silent Cry of Parameters: Hunting Logic and Architecture in Modern Web Apps
When you multiply the 'amount' parameter in a checkout request by -1 and the server returns a 200 OK, your entire security architecture just became a paper tiger. Let's dive into why logic and architecture hunting is the real frontier of modern security.
Invisible Doors: The 'Help Yourself Without Asking' Logic in the API World
Hacking has evolved from simple SQL Injections to complex logic flaws. In this post, we dive into BOLA (Broken Object Level Authorization), the sneaky vulnerability that often bypasses automated scanners and how to spot it before the bad guys do.
Leaving the API Doors Unlocked: Did You Really Think a JWT Was Enough?
Have you ever felt that cold sweat down your neck when you realize your API is serving your entire database to the internet? Let's talk about the most common 'invisible' vulnerability: BOLA.
The Keyless Lock of Invisible Doors: Why 'IDOR' is Just the Tip of the Iceberg in Modern API Security
A deep dive into the shift from monoliths to microservices and how logic flaws like BOLA have become the new frontier for Red Team operations.
Unlocking Invisible Doors: IDOR and the Silent Guests at API Backdoors
Ever seen someone else's invoice just by changing a number in the URL? That's IDOR. Let’s look at why this 'old but gold' vulnerability still haunts modern APIs and how we can secure our systems.
What Happens When You Change Just One Digit? The Silent Scream of IDOR
A deep dive into why authorization flaws like IDOR and business logic errors remain the 'invisible' threats that automated scanners often miss, told through real-world Red Team experience.
Saving Pennies or Stashing Bugs? Tales from the Bug Bounty Trenches
Bug bounty isn't just about finding flaws; it’s about outsmarting the system and staying patient. Here’s a look at the real grind behind the hunt.