DDimakatso Sebatane·Oct 18Case Study: Cross-Tenant Data Exfiltration via Backup RestoreHow broken tenant isolation and missing authorization checks in backup restoration can allow attackers to access sensitive data belonging to other organizations. Full video at : https://youtu.be/AshvGLWsclw9 min read·ovawatch-security.hashnode.dev
ZZyVOP·Sep 25IDOR Vulnerabilities in NestJS: How to Build Ownership Guards That Actually Protect Your DataYour JWTs are working perfectly. Your database is leaking anyway — here's why authentication and authorization are not the same thing, and how to close the gap in NestJS + PostgreSQL15 min read·blog.zyvop.com
DDavid Essien·Sep 19What a Single File Name Taught Me About IDOR (PortSwigger Lab)A PortSwigger access control lab where a chat transcript downloaded as 2.txt, and that one detail was the whole vulnerability.4 min read·david-essien.hashnode.dev
AAmartya Jha·Sep 8IDOR: The Vulnerability Class Your Scanners Will Never FindIDOR causes some of the worst SaaS breaches and most scanners can't see it. Here's the full technical breakdown, testing, and fixes.11 min read·security-research.hashnode.dev
YYogeshwar Peela·Aug 25HackSmarter - Casino WriteupSummary Casino is a Flask-based "Guest WiFi & Portal" resort captive portal. A leaked JS source-map exposes an unauthenticated internal API endpoint (/api/v1/rooms/status) that dumps the entire guest11 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Aug 18TryHackMe: Corridor - WriteupSolve TryHackMe Corridor by identifying MD5-based door URLs, testing the missing value, and finding the hidden flag through simple logic.4 min read·exploitnotes.hashnode.dev
SSunny·Aug 11TryHackMe Corridor Beginner-Friendly Learning GuideUnderstanding IDOR, broken access control, object references, URL endpoints, hash-like identifiers, and defensive access control through the TryHackMe Corridor room.11 min read·cybersecurity-learning.hashnode.dev
YYogeshwar Peela·Jul 13HackTheBox: NeoVault Challenge WriteupSolve Neo Vault by exploiting NoSQL injection to leak ObjectIds, then abusing a legacy v1 IDOR to download the flag-containing bank statement PDF.8 min read·exploitnotes.hashnode.dev
JJebitok·Jun 3API Pentesting (TryHackMe)Link to the Walkthrough & Challenge on TryHackMe: API Pentesting Introduction An API (Application Programming Interface) is a structured interface that enables software components to communicate with25 min read·sharonjebitok.com
WWiktoria Blomgren Strandberg·Mar 21API Security in DVWADocumented penetration test of API Security vulnerability in DVWA.29 min read·pentesting-dvwa.hashnode.dev
