---
id: 1709
title: "IDORs with unpredictable IDs are valid vulnerabilities"
source_domain: josephthacker.com
source_url: "https://josephthacker.com/hacking/cybersecurity/2022/08/18/unpredictable-idors.html"
published_at: "2022-08-18T00:00:00Z"
tags: ["bug-bounty", "web-security", "idor", "methodology"]
phying_url: "https://phying.com/item/1709"
lang: en
---

# IDORs with unpredictable IDs are valid vulnerabilities

## Summary

Joseph Thacker argues IDORs remain valid vulnerabilities even when IDs are unpredictable UUIDs, listing practical ways attackers obtain them: Wayback Machine, AlienVault OTX and URLScan archives, shared documents, referrer leaks and more.

## Intelligence Metadata

- **Sources:** josephthacker.com
- **Published:** 2022-08-18T00:00:00Z
- **Original:** https://josephthacker.com/hacking/cybersecurity/2022/08/18/unpredictable-idors.html
- **Phying News:** https://phying.com/item/1709