IDOR — The Easiest Critical Bug You’ll Ever Find

If you only learn one bug type to start, make it this one. IDOR. It's beginner-friendly, it pays really well, and honestly it's one of the most rewarded bugs in bug bounty right now. Let's go.

What Is IDOR? (The Locker Example)

Imagine a gym with numbered lockers. You get locker #1234. You go to it, open it, your stuff is inside. Cool.

But what if you walked to locker #1235 — and it just opened for you? Even though it's not yours? That's IDOR. Insecure Direct Object Reference.

The app trusts the number (ID) you give it without checking if you're ALLOWED to access it. So you ask for someone else's data… and the server just hands it over. 😳

What It Looks Like In Real Life

You log in and check your profile. The URL is:

example.com/api/user/1234

That 1234 is YOUR ID. So what's the test? Change it.

example.com/api/user/1235

If you suddenly see ANOTHER person's private info — their name, email, address, orders — congratulations, you found an IDOR. 🎯

Where To Hunt For It

Look anywhere the app uses an ID or reference:

/user/1234 → change the number
/order/5500 → view someone else's order
/invoice/download?id=900 → grab someone's invoice
/api/account/abc123 → swap the reference
Hidden fields in requests (account_id, uid, file)

How To Test It Properly (The Two-Account Trick)

Here's the pro move that makes your report bulletproof:

Create two accounts — User A and User B
Log in as User A, note your ID (say 1000)
Log in as User B, note your ID (say 1001)
As User A, try to access User B's data (request ID 1001)
If it works → you've PROVEN one user can read another's private data

That clean proof is exactly what gets your report accepted and paid.

Why Companies Pay Big For This

Because the impact is huge and the fix is "obvious in hindsight." If I can read any user's data just by changing a number, that's a privacy disaster — and it can affect millions of accounts. High impact, low complexity. That's the dream bug.

My Honest Tip

Watch out for IDs that aren't obvious numbers. Sometimes they're encoded (base64), sometimes they're in headers, sometimes buried in JSON. Decode things. Poke at every ID you see. The lazy hunters skip the non-obvious ones — that's your opening.

Next post: XSS, starting with reflected. We're getting into the classics now.

Happy hunting! 🔑