#idor
2 articles
XSS Meets IDOR: A Double Vulnerability Story on a Learning Platform 🔥
Chaining a stored HTML injection, an IDOR on predictable blog IDs, and stored XSS into full account takeover on a learning platform.
·5 min readWhy IDORs Are Everywhere — And How to Find Them — Part I
How predictable sequential IDs exposed thousands of customer invoices, plus a methodology for spotting horizontal, vertical, and blind IDORs.
·5 min read