---
id: 3195
title: "How-To: Find IDOR (Insecure Direct Object Reference) Vulnerabilities for Large Bounty Rewards"
source_domain: bugcrowd.com
source_url: "https://www.bugcrowd.com/blog/how-to-find-idor-insecure-direct-object-reference-vulnerabilities-for-large-bounty-rewards/"
published_at: "2017-11-09T00:00:00Z"
tags: ["bug-bounty", "burp-suite", "web-security", "idor", "tutorial", "authorization"]
phying_url: "https://phying.com/item/3195"
lang: en
---

# How-To: Find IDOR (Insecure Direct Object Reference) Vulnerabilities for Large Bounty Rewards

## Summary

Guest researchers Mert and Evren explain how IDOR lets attackers manipulate id or uid parameters to access other users' objects, and share testing tips using browser session isolation and Burp Suite.

## Intelligence Metadata

- **Sources:** bugcrowd.com
- **Published:** 2017-11-09T00:00:00Z
- **Original:** https://www.bugcrowd.com/blog/how-to-find-idor-insecure-direct-object-reference-vulnerabilities-for-large-bounty-rewards/
- **Phying News:** https://phying.com/item/3195