PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

IDORs with unpredictable IDs are valid vulnerabilities

josephthacker.com | blog | #bug-bounty | #web-security | #idor | #methodology
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Joseph Thacker argues IDORs remain valid vulnerabilities even when IDs are unpredictable UUIDs, listing practical ways attackers obtain them: Wayback Machine, AlienVault OTX and URLScan archives, shared documents, referrer leaks and more.
Published
Collected

Related coverage

blog · github.com
HowToHunt: Practical Methodologies and Test Cases for Web Vulnerability Hunting
Consolidates battle-tested bug bounty hunting checklists and methodologies into structured, actionable guides for security researchers and penetration testers.
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
vulnerability · vercel.com
The Vercel Bug Bounty Program is now publicly available
Vercel's Bug Bounty Program is now public on HackerOne, covering all Vercel products and open-source projects. Learn how to participate and report findings.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
blog · bishopfox.com
Wodify
Wodify advisory on three chained flaws: an IDOR exposing all tenants' workout data, stored XSS via tampered data, and sensitive info disclosure; worst case, payment settings could be tampered with.
Back