PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Rise of IDOR

hackerone.com | blog | #access-control | #web-security | #idor | #hackerone | #broken-access-control | #vulnerability-trends
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

IDOR lets attackers access other users' data via tweaked parameters, 200+ found monthly on HackerOne. The article covers IDOR types, Shopify and Parler cases, and why tools alone can't find them.
Published
Collected

Related coverage

blog · bugbunny.ai
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
Insecure direct object reference: the app exposes an object ID but never checks ownership, tenant or role—one user reads another's data; fix with centralized object authorization and negative tests.
blog · labs.cognisys.group
Securing the Insecure Objects
Overview
blog · blog.viettelcybersecurity.com
Thanh xuân như một tách trà, tìm được một bug hết bà thanh xuân.
A bug bounty write-up on a restaurant management platform where staged tenant accounts revealed cross-restaurant IDOR and broken function-level authorization across web and mobile APIs.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase
HackerOne ran Anthropic's Mythos 5 model against its own production code; it surfaced a critical RCE spanning three safe-in-isolation commits, illustrating compositional risk that diff review misses.
Back