IDOR hunting workflow I keep coming back to:
1) Map object IDs (UUIDs, ints, slugs) across endpoints (REST + GraphQL).
2) Change one dimension at a time: user_id, org_id, project_id.
3) Watch for soft failures: 200 with partial data, empty arrays, unexpected responses.
4) Test non-GETs too: PATCH/DELETE often skip the same checks.
5) Test for different paths/platforms: UI vs API vs mobile vs webapp.
Most IDORs aren’t fancy, they’re just inconsistent, and it only takes one.
Weird graphQL IDOR / access control bypass:
In this one, graphQL would check the "tin" (tax identification number), if supplied, against the Bearer token. If the Bearer did not have access to the tin, you would get access denied. Normal stuff there. So my thought was, how could I make the server still lookup the tin value without the access check?
It regularly expected:
\"tin\"
This causes the server, since "tin" is present, to check access control prior to returning data.
What worked was:
\"tin\\\"\"
So adding \\\" after tin bypassed the access control logic (for some reason), meanwhile the graphQl query still ran and sent back the PII for any TIN I sent it.
#bugbounty is just strange sometimes. Some of the battle is finding neat endpoints and places, and some of it is endless tinkering.
It’s time to lock in. If you’re struggling with bug bounties, spend the next few weeks finding a target you personally enjoy. Bigger the scope the better! Then focus on them everyday for the entire year. Aim to hack 2-3 hours minimum a day. You’ll learn lots and find bugs.
GL!
In this write-up, I detail how I escalated info/P4 into P1 and avoided brute-force 36^11 for UUIDs by exploiting typical human behavior.
https://t.co/C2qAUB14iZ
Late one, hunted for 2 weeks in December and made $6000+. Excited for what we can achieve this year. Below are some writeups I published in 2025:
$1,500 Recon Tips: https://t.co/gOMDxw9etm
Lets $ Leak $ OTP: https://t.co/m2w8rcWOqq
From 429 to 200: https://t.co/VWEt9HM6YT
Hello everyone,
🧵Zero-click account takeover via Punycode email.
One of the most critical and interesting vulnerabilities I’ve discovered recently leads to a full account takeover with zero user interaction.
(1/7)