Hi folks, I am Kapil Varma, a cybersecurity enthusiast and security researcher from India! This is my 2nd writeup on IDOR vulnerability…suggestions and appreciation is welcomed…hope this article will be helpful and y’all would like it! Let’s head to the write-up now! What exactly IDOR is? In a web application…

As I was just messing up with my cousin’s Institute Portal, I noticed its login area and got curious to test its functionalities. I got his credentials for that portal and intercepted its login request to Burpsuite. The request was given in the following format: POST /login/process HTTP/1.1 Host: target.com User-Agent: Mozilla/5.0…