ASAbdulaziz Saadinblog.abdulaziz-d.com·Aug 18 · 10 min readThe $1000 Ticket IDOR: One Number Exposed National IDs and Government Staff PIISeverity: HighBounty: ~$949Program: Private Bug BountyPlatform: Bugbounty.sa This finding started with a very simple endpoint: GET /api/tickets-management/portal/history-by-ticket/<ticket_id> The end30
ASAbdulaziz Saadinblog.abdulaziz-d.com·Aug 17 · 12 min readFrom Editor to Owner: One Writable Field Was Enough to Take Over an OrganizationSeverity: HighBounty: ~$315Platform: Standoff365 This one came down to a single field that should never have been writable by an editor: Firm[user_id] The application had a clear permission model. An10
ASAbdulaziz Saadinblog.abdulaziz-d.com·Aug 7 · 12 min readA $2,000 API Key: Unauthorized Access to Paid Medical TranscriptionSeverity: HighBounty: $2,000Retest Reward: $150Total Awarded: $2,150Program: Private ProgramPlatform: HackerOne This finding started with a familiar Android testing problem: What secrets were shipped00
ASAbdulaziz Saadinblog.abdulaziz-d.com·Jul 30 · 13 min readFrom Profile IDOR to Zero-Click Account Takeover: Changing One userid Parameter Was EnoughSeverity: CriticalBounty: $1,805Program: Private Bug BountyPlatform: Bugbounty.sa This started as a straightforward profile IDOR. An authenticated user could change a userid parameter and load another21N
ASAbdulaziz Saadinblog.abdulaziz-d.com·May 21 · 6 min readIDOR in Government Ownership API Exposed Private Business Owner PII via CR Number EnumerationSeverity: HighBounty Awarded: $1,506Program: Private Bug BountyPlatform: Bugbounty.sa Some IDORs are obvious immediately. You change an ID. Someone else’s data appears. Easy. Others look harmless at f00
