How i was able to steal private files of any user on Larksuite
Target Program: -
🎯 Vulnerability: Insecure Direct Object Reference (IDOR)
💡 Defense Fix: Enforce object-level access control checks (ABAC/RBAC) on the server side for every API request.
More Writeups Like This
dev.to
by ohugonnotBOLA, the #1 API Vulnerability: a One-Line Fix and an A-B Test in Go and PHP
medium.com/tag/ctf-writeup
by Amrik HoreHTB OnlyHacks Walkthrough
medium.com/tag/penetration-testing
by Samadhan shimpleIDOR Hunting Techniques Every Bug Bounty Hunter Should Know | by Samadhan Shimple
medium.com/tag/bug-bounty
by MUWAFAK HELAL