PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

PimpMyBurp #1 – PwnFox + Autorize: The perfect combo to find IDOR

yeswehack.com | blog | #bug-bounty | #burp-suite | #idor | #tooling | #autorize | #pwnfox
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PimpMyBurp #1 explains combining PwnFox — a Firefox container-based multi-session extension — with Autorize to streamline IDOR hunting by color-coding sessions and replaying requests automatically.
Published
Collected

Related coverage

blog · netspi.com
Introducing Burp Extractor
Will Strei introduces Burp Extractor, a Burp Suite extension that extracts dynamic values like anti-CSRF tokens from responses via regex and reinserts them into requests, a generalized cookie jar.
blog · netspi.com
Beautifying JSON in Burp
A native Java Burp extension that beautifies JSON in place, letting testers read and live-edit nested API responses without Jython, with edits synced back to the raw request tab.
blog · yeswehack.com
‘It was a revelation’: lemonoftroy’s origin story and hacking methodology
Interview with Adrián Pedrazzoli (lemonoftroy): his path into hacking, a preference for IDORs and access control bugs, a manual minimal-tool methodology, and advice for new hunters.
blog · yeswehack.com
‘There are a lot of vulnerabilities on public programs’: pwnii’s Bug Bounty journey so far
Q&A with YesWeHack hunter pwnii (ranked 49th): entering Bug Bounty via CTFs, her favourite mobile IDOR account-takeover find, tools like Burp Suite with PwnFox, and tips for newcomers.
blog · yeswehack.com
‘My best attribute is persistence – technical skills you can learn’: drak3hft7’s Bug Bounty story so far
Q&A with Italian hunter drak3hft7 (Simone Paganessi, 8th on YesWeHack's 2024 leaderboard with 656 reports): soft skills over technical ability, his critical IDOR find, and favourite tools like Ghauri.
blog · portswigger.net
Heading to San Francisco? Meet PortSwigger at OWASP Global AppSec USA 2026
Join us at booth G14 on 5–6 November at the Hyatt Regency San Francisco. We’re a Gold sponsor, with live Burp AT demos, conversations about your AppSec programme, and something new to share. OWASP is
Back