IDOR Hunting

Single most paid vuln class in BB history. Boring to test, lucrative to find.

When to invoke

Trigger phrases:

• "test IDOR"
• "find IDOR in X"
• "is this endpoint vulnerable to IDOR"
• "cross-tenant"
• "object reference"

Pre-requisites