IDOR - how to predict an identifier? Bug bounty case study

[@BugBountyReportsExplained]

Welcome to the comment section. If you don't want to miss my future case studies, join BBRE Newsletter for free at bbre.dev/nl

[@moizpasha7852]

Great vid! One of the weirdest IDORs I found used a UNIX epoch timestamp format as an identifier. I spent a lot of time bruteforcing it, but since I was only changing the time by a matter of milliseconds (I did not know what a UNIX timestamp was) I did not get to exploit it. Reported it anyway and got informed that it was a P1.

[@normalitee0os]

Your channel is just absolute gold man!

[@AbdAlkarimTube]

Nice topic! We need more on BAC. Thanks!

[@eyezikandexploits]

Veen heavy in idor lately this video was nice and perfect timing

[@monKeman495]

Much appreciated detailed case study of IDOR bug class can we expect your 20k aws misconfiguration vid next ?

[@BugBountyReportsExplained]

I'm not sure if next but I'll definitely do it😉

[@guillermoslomon6738]

I really like the way you explain it, thank you

[@duskb1t]

I really enjoy your content. You have a new active sub

[@andrezaantonelli5024]

Thank you so much for your help and your time.

[@johnnyonpc6799]

Just found your channel, very good content I'd say. Keep it up! Subbed.

[@BugBountyReportsExplained]

Welcome aboard!

[@CristiVladZ]

I love these case studies!

[@leghdaf]

Great Content ...

[@musaumarfaruq8675]

Where can I find all the bug reports

[@ahmetsaric5364]

Thank you

[@grassy-p12]

Yeah its so informative😍

[@MFoster392]

Gret video thanks

[@EndlessTech]

According to you how many people in world are there in Penetration testing and ethical hacking in cybersecurity like range or gesture for example 4-5 million, etc.

[@BugBountyReportsExplained]

I have no idea

[@sxhil.d3v]

can u share all reports coz i just started idk much idors

[@BugBountyReportsExplained]

They are all shared in BBRE Premium archive

[@GajendraMahat]

which website he is using to view all the writeup

[@BugBountyReportsExplained]

It's on my website as a part of BBRE Premium

[@GajendraMahat]

@@BugBountyReportsExplained 🥺🥺👍

[@32_jadav_akash22]

If the identifier is long or uuid it could be found on the Wayback machine it is still a valid report??

[@BugBountyReportsExplained]

rez0 has a great blogpost about the topic: rez0.blog/hacking/cybersecurity/2022/08/18/unpredictable-idors.html

[@M7moudx22]

it's possbile to upload write-ups file ?

[@BugBountyReportsExplained]

It's uploaded in the BBRE Premium archive

[@bibekdhakal3887]

😁😁