Tag
#web
2 posts
infosec
IDOR via predictable IDs: a logic bug dressed as auth
When UUIDs in the URL aren't secret — and the API never checks ownership.
infosec
Logic bugs in checkout flows
When the price is right in the UI but wrong in the API — and how hunters find it.