Curated security research, vulnerabilities, advisories and tools for practitioners.

#idor

Security coverage tagged idor.

1.

API Vulnerability Scanner: What to Automate and What to Validate Manually

blog | 2026-06-24 07:00 | bugbunny.ai | original ↗ | #appsec | #vulnerability-management | #api-security

2.

Aikido x OWASP: 200 free credits for individual members

blog | 2026-06-18 00:00 | aikido.dev | original ↗ | #ai-security | #appsec | #devsecops

3.

The Generalist Advantage in Agentic Pentesting

blog | 2026-06-17 00:00 | tenzai.com | original ↗ | #ai-security | #rce | #access-control

4.

HackenProof Customer Story: Uklon

blog | 2026-06-05 10:28 | hackenproof.com | original ↗ | #bug-bounty | #xss | #idor

5.

Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight

blog | 2026-05-31 07:00 | bugbunny.ai | original ↗ | #appsec | #vulnerability-research | #access-control

6.

Getting to “Should I?”, Instead of “Can I?”: How XBOW Finds IDORs With High Accuracy in Ambiguous Contexts

blog | 2026-05-28 12:00 | xbow.com | original ↗ | #ai-security | #agentic-ai | #appsec

7.

What Is Insecure Direct Object Reference (IDOR), and How Do You Test for It?

blog | 2026-05-06 12:00 | xbow.com | original ↗ | #ai-security | #pentesting | #access-control

8.

Tales From the Trace: How XBOW Reasons Its Way Into Finding IDORs

blog | 2026-02-04 13:00 | CVE-2026-22588 | xbow.com | original ↗ | #agentic-ai | #appsec | #vulnerability-research

9.

How I sped up exploit validation in Repeater using Burp AI

blog | 2026-01-22 15:18 | portswigger.net | original ↗ | #ai-security | #idor | #workflow

10.

IDOR Vulnerabilities Explained: Why They Persist in Modern Applications

blog | 2026-01-02 00:00 | aikido.dev | original ↗ | #appsec | #access-control | #web-security

11.

‘It was a revelation’: lemonoftroy’s origin story and hacking methodology

blog | 2025-08-08 09:15 | yeswehack.com | original ↗ | #bug-bounty | #access-control | #idor

12.

Repeater Strike: manual testing, amplified

research | 2025-07-15 13:46 | portswigger.net | original ↗ | #ai-security | #burp-suite | #automation

13.

Access Control vs Account Takeover: What Bug Bounty Hunters Need to Know

blog | 2025-07-03 12:00 | bugcrowd.com | original ↗ | #bug-bounty | #access-control | #account-takeover

14.

‘There are a lot of vulnerabilities on public programs’: pwnii’s Bug Bounty journey so far

blog | 2025-01-06 12:03 | yeswehack.com | original ↗ | #bug-bounty | #burp-suite | #mobile-security

15.

‘My best attribute is persistence – technical skills you can learn’: drak3hft7’s Bug Bounty story so far

blog | 2024-12-11 09:24 | yeswehack.com | original ↗ | #bug-bounty | #idor | #interview

16.

Why you aren’t finding bugs

blog | 2024-10-22 15:00 | bugcrowd.com | original ↗ | #bug-bounty | #xss | #idor

17.

How an IDOR Vulnerability Led to User Profile Modification

vulnerability | 2024-10-08 20:53 | hackerone.com | original ↗ | #bug-bounty | #web-security | #idor

18.

Pentesting for Web Applications

blog | 2024-07-10 16:00 | hackerone.com | original ↗ | #pentesting | #web-security | #idor

19.

Announcing Our Latest Vulnerability Rating Taxonomy Update

vulnerability | 2023-11-27 16:00 | bugcrowd.com | original ↗ | #bug-bounty | #cryptography | #idor

20.

Securing the Insecure Objects

research | 2023-08-23 01:00 | labs.cognisys.group | original ↗ | #pentesting | #access-control | #web-security

21.

Hacking on a plane: Leaking data of millions and taking over any account

blog | 2022-12-02 00:00 | josephthacker.com | original ↗ | #ai-security | #bug-bounty | #account-takeover

22.

IDORs with unpredictable IDs are valid vulnerabilities

blog | 2022-08-18 00:00 | josephthacker.com | original ↗ | #bug-bounty | #web-security | #idor

23.

The Most Overlooked Server Permission Checks

blog | 2022-06-23 16:00 | hackerone.com | original ↗ | #access-control | #code-review | #api-security

24.

How to Catch the Top OWASP 2021 Security Category - Broken Access Control - in Code Review

blog | 2022-01-03 00:00 | hackerone.com | original ↗ | #access-control | #code-review | #web-security

25.

blog | 2021-08-13 00:00 | bishopfox.com | original ↗ | #web-security | #xss | #idor

26.

The Rise of IDOR

blog | 2021-04-02 15:00 | hackerone.com | original ↗ | #access-control | #web-security | #idor

27.

PimpMyBurp #2 – Auth Analyzer : How to test horizontal and vertical privileges escalation

vulnerability | 2021-02-17 13:38 | yeswehack.com | original ↗ | #bug-bounty | #burp-suite | #privilege-escalation

28.

PimpMyBurp #1 – PwnFox + Autorize: The perfect combo to find IDOR

blog | 2021-02-03 13:42 | yeswehack.com | original ↗ | #bug-bounty | #burp-suite | #idor

29.

These Are the Bugs You Should Look for in Late 2020

blog | 2020-10-08 00:00 | bugcrowd.com | original ↗ | #bug-bounty | #sql-injection | #xss

30.

Meet InnoGames’ Top Hacker

blog | 2020-01-27 18:00 | hackerone.com | original ↗ | #bug-bounty | #idor | #interview