The community
Inside people ask, share what they found and solve together what would block anyone on their own. It's free to join: no account, no plan, no email required.
Free and open. You don't need a BBLABS account to join.
Learn to identify and exploit IDOR (Insecure Direct Object Reference) vulnerabilities in web applications. From the basics to writing effective reports.
BBLabs
Security Researcher
Stop reading about bugs and start hunting them
No card · free Academy · cancel anytime
IDOR (Insecure Direct Object Reference) is one of the most common and most rewarded vulnerabilities in bug bounty programs. It happens when an application exposes a direct reference to an internal object — like a user ID, a filename or a database key — without checking that the user is authorized to access that resource.
In simple terms: if you can change a number in a URL or a request and access another user's data, you're probably looking at an IDOR.
The most frequent type. A user accesses resources belonging to another user at the same privilege level. For example:
GET /api/users/1234/profile → Your profile
GET /api/users/1235/profile → Another user's profile (unauthorized!)
Happens when a user with low privileges accesses functions meant for a high-privilege user (for example, a normal user reaching an admin panel):
GET /api/admin/users → Should only be accessible to admins
GET /api/admin/settings → System settings
It's not always about reading data. Sometimes you can perform actions on resources that aren't yours:
DELETE /api/posts/5678 → Delete another user's post
PUT /api/users/1235/email → Change another user's email
Use Burp Suite to intercept every request as you browse the application. Pay special attention to any parameter that contains IDs, UUIDs, filenames or object references.
Look for patterns like:
/api/v1/users/{user_id}/orders
/api/v1/documents/{doc_id}/download
/api/v1/invoices?id=12345
/profile?account=usuario123
This is the most effective technique. Create two test accounts (Account A and Account B):
If the IDs are numeric and sequential, try Burp Intruder:
GET /api/users/§1§/profile HTTP/1.1
Authorization: Bearer your_token_here
Payload: Numbers, From 1 To 1000, Step 1
Sometimes the same endpoint accepts different formats:
/api/users/123 → Numeric ID
/api/users/user_123 → Prefixed ID
/api/users/abc-def-ghi → UUID
/api/users/admin@test.com → Email as identifier
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
/api/users/{id}, /profile/{id}/api/files/{file_id}/download, /documents/{name}.pdf/api/export?report_id=123/api/messages/{id}, /api/notifications/{id}/api/transactions/{id}If the first attempt doesn't work, try these variations:
# Change the HTTP method
GET → POST, PUT, PATCH
# Add/remove parameters
/api/users/123 → /api/users/123?admin=true
# Change the ID format
123 → 0123 → 00123
# Encode the ID
123 → MTIz (Base64)
# Try the ID in different locations
Body, URL, Headers, Cookies
IDORs are "simple" vulnerabilities in concept but extremely impactful. They're an excellent gateway into the bug bounty world because they don't require highly advanced technical knowledge, but they do require patience, methodology and attention to detail. Practice with lab platforms and you'll soon be reporting your first real bugs.
hunters training
labs from real hacks
completions
paid out for these bugs
Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime
Explore the most common techniques for attacking insecure JSON Web Token implementations: from the none algorithm to JKU/JWK injection.
Learn to escalate SSRF vulnerabilities from a low severity to critical impact. Exploitation techniques, filter bypasses and attack chains in cloud environments.
What bug bounty is, how a program works step by step, which platforms it runs on (HackerOne, Bugcrowd, Intigriti, YesWeHack), how much you earn, whether it's legal and where to start from scratch.