--- title: "#idor articles | Hashnode" description: "Explore 35 articles tagged #idor on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/idor" --- Tag # #idor 35 posts · 3 followers [Dimakatso Sebatane](https://hashnode.com/@ovawatch-security) · [Oct 18](https://hashnode.com/posts/case-study-cross-tenant-data-exfiltration-via-backup-restore/6ad6108301bf51809c3a6b0f) ### [Case Study: Cross-Tenant Data Exfiltration via Backup Restore](https://ovawatch-security.hashnode.dev/case-study-cross-tenant-data-exfiltration-via-backup-restore?utm_source=hashnode&utm_medium=feed) How broken tenant isolation and missing authorization checks in backup restoration can allow attackers to access sensitive data belonging to other organizations. Full video at : https://youtu.be/AshvGLWsclw 9 min read · [ovawatch-security.hashnode.dev](https://ovawatch-security.hashnode.dev/case-study-cross-tenant-data-exfiltration-via-backup-restore?utm_source=hashnode&utm_medium=feed) [ZyVOP](https://hashnode.com/@zyvop) · [Sep 25](https://hashnode.com/posts/idor-vulnerabilities-in-nestjs-how-to-build-ownership-guards-that-actually-protect-your-data/6ab6a7119160c4403d21a3ff) ### [IDOR Vulnerabilities in NestJS: How to Build Ownership Guards That Actually Protect Your Data](https://blog.zyvop.com/idor-vulnerabilities-in-nestjs-how-to-build-ownership-guards-that-actually-protect-your-data?utm_source=hashnode&utm_medium=feed) Your JWTs are working perfectly. Your database is leaking anyway — here's why authentication and authorization are not the same thing, and how to close the gap in NestJS + PostgreSQL 15 min read · [blog.zyvop.com](https://blog.zyvop.com/idor-vulnerabilities-in-nestjs-how-to-build-ownership-guards-that-actually-protect-your-data?utm_source=hashnode&utm_medium=feed) [David Essien](https://hashnode.com/@davidessien) · [Sep 19](https://hashnode.com/posts/what-a-single-file-name-taught-me-about-idor-portswigger-lab/6aae3716aba8a64317cad7e8) ### [What a Single File Name Taught Me About IDOR (PortSwigger Lab)](https://david-essien.hashnode.dev/what-a-single-file-name-taught-me-about-idor-portswigger-lab?utm_source=hashnode&utm_medium=feed) A PortSwigger access control lab where a chat transcript downloaded as 2.txt, and that one detail was the whole vulnerability. 4 min read · [david-essien.hashnode.dev](https://david-essien.hashnode.dev/what-a-single-file-name-taught-me-about-idor-portswigger-lab?utm_source=hashnode&utm_medium=feed) [Amartya Jha](https://hashnode.com/@codeant-security) · [Sep 8](https://hashnode.com/posts/idor-the-vulnerability-class-your-scanners-will-never-find/6a9fb276de8043dad9d0e87a) ### [IDOR: The Vulnerability Class Your Scanners Will Never Find](https://security-research.hashnode.dev/idor-the-vulnerability-class-your-scanners-will-never-find?utm_source=hashnode&utm_medium=feed) IDOR causes some of the worst SaaS breaches and most scanners can't see it. Here's the full technical breakdown, testing, and fixes. 11 min read · [security-research.hashnode.dev](https://security-research.hashnode.dev/idor-the-vulnerability-class-your-scanners-will-never-find?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 25](https://hashnode.com/posts/hacksmarter-casino-writeup/6a8d92c3fd8f07aabbc31d74) ### [HackSmarter - Casino Writeup](https://exploitnotes.hashnode.dev/hacksmarter-casino-writeup?utm_source=hashnode&utm_medium=feed) Summary Casino is a Flask-based "Guest WiFi & Portal" resort captive portal. A leaked JS source-map exposes an unauthenticated internal API endpoint (/api/v1/rooms/status) that dumps the entire guest 11 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/hacksmarter-casino-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 18](https://hashnode.com/posts/tryhackme-corridor-writeup/6a842a5c7ad6b5edd1080ef5) ### [TryHackMe: Corridor - Writeup](https://exploitnotes.hashnode.dev/tryhackme-corridor-writeup?utm_source=hashnode&utm_medium=feed) Solve TryHackMe Corridor by identifying MD5-based door URLs, testing the missing value, and finding the hidden flag through simple logic. 4 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-corridor-writeup?utm_source=hashnode&utm_medium=feed) [Sunny](https://hashnode.com/@sunny1103) · [Aug 11](https://hashnode.com/posts/tryhackme-corridor-beginner-friendly-learning-guide/6a7b300e236f7c3e6c5bc800) ### [TryHackMe Corridor Beginner-Friendly Learning Guide](https://cybersecurity-learning.hashnode.dev/tryhackme-corridor-beginner-friendly-learning-guide?utm_source=hashnode&utm_medium=feed) Understanding IDOR, broken access control, object references, URL endpoints, hash-like identifiers, and defensive access control through the TryHackMe Corridor room. 11 min read · [cybersecurity-learning.hashnode.dev](https://cybersecurity-learning.hashnode.dev/tryhackme-corridor-beginner-friendly-learning-guide?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Jul 13](https://hashnode.com/posts/hackthebox-neovault-challenge-writeup/6a549a31cb8d87bccd25c05a) ### [HackTheBox: NeoVault Challenge Writeup](https://exploitnotes.hashnode.dev/hackthebox-neovault-challenge-writeup?utm_source=hashnode&utm_medium=feed) Solve Neo Vault by exploiting NoSQL injection to leak ObjectIds, then abusing a legacy v1 IDOR to download the flag-containing bank statement PDF. 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/hackthebox-neovault-challenge-writeup?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Jun 3](https://hashnode.com/posts/api-pentesting-tryhackme/6a20877202f7c5ee1fafb913) ### [API Pentesting (TryHackMe)](https://www.sharonjebitok.com/api-pentesting-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the Walkthrough & Challenge on TryHackMe: API Pentesting Introduction An API (Application Programming Interface) is a structured interface that enables software components to communicate with 25 min read · [sharonjebitok.com](https://www.sharonjebitok.com/api-pentesting-tryhackme?utm_source=hashnode&utm_medium=feed) [Wiktoria Blomgren Strandberg](https://hashnode.com/@wikipedia01) · [Mar 21](https://hashnode.com/posts/api-security/69bea5934a1e513e41f701e9) ### [API Security in DVWA](https://pentesting-dvwa.hashnode.dev/api-security?utm_source=hashnode&utm_medium=feed) Documented penetration test of API Security vulnerability in DVWA. 29 min read · [pentesting-dvwa.hashnode.dev](https://pentesting-dvwa.hashnode.dev/api-security?utm_source=hashnode&utm_medium=feed)