The IDOR that leaked every invoice in a fintech app
A single predictable ID exposed every customer's invoices. How I found it, and how they fixed it.
webidor
My first 30 minutes on any engagement
Before I touch a single exploit, I spend half an hour just looking. Here's the checklist.
reconmethodology