Broken Object Fiesta: How I Used IDOR, No Auth, and a Little Luck to Pull User Data

Free Link 🎈

Hey there!😁

Image by Gemini Ai

I once ordered biryani and got plain rice. That same week, my barber gave me a haircut that made me look like a QR code. Nothing was going my way… until I found an IDOR that handed me sensitive user data like candy on Halloween. 🎃

It started like every sad bug hunter tale — one browser tab open, 45 terminal windows running, and hopes lower than my bank balance. But what happened next restored my faith in broken access control. Let’s go!

I began with my regular recon ritual:

subfinder -d target.com -o subs.txt
httpx -l subs.txt -status-code -title -o live.txt
gau --subs target.com > params.txt

While scrolling through params.txt, I found this endpoint:

https://api.target.com/v2/profile/getProfileDetails?id=123456

Looks boring, right? But here’s the kicker — this API worked without authentication. Yep, no tokens, no cookies, just vibes.