🔐 Hacking My Way to $3,000: Unmasking a Sneaky IDOR Vulnerability 🕵️♂️

How I Exploited an Overlooked Flaw and Landed a Major Bug Bounty 🚀

🌟 Introduction

Bug bounty hunting is like a digital treasure hunt — except the gold is real, and the maps are written in code. In this blog, I’ll walk you through how I discovered an Insecure Direct Object Reference (IDOR) vulnerability that allowed me to access any user’s private data on a popular SaaS platform — and earned me a $3,000 reward. Let’s break it down!

🎯 Picking the Target: Where to Aim Your Scope

I chose a project management tool with a growing user base and a HackerOne program offering bounties up to $5,000. Here’s why:

• User-centric features: File sharing, messaging, and role-based permissions.
• Complex API structure: Lots of endpoints = lots of potential flaws.
• Recent feature launches: New code often hides overlooked vulnerabilities.

🔍 The “Wait, That Shouldn’t Happen” Moment

While testing the platform’s “Documents” feature, I noticed that accessing files used a simple numeric ID in the URL:

GET /api/v1/documents/12345