https://blog.sicks3c.io/tags/idor/Recent content in Idor on SicksecHugo -- gohugo.ioen© 2026 SicksecWed, 26 Feb 2025 07:32:53 +0800https://blog.sicks3c.io/posts/how-i-scored-2k-bounty-via-an-idor/Wed, 26 Feb 2025 07:32:53 +0800https://blog.sicks3c.io/posts/how-i-scored-2k-bounty-via-an-idor/<p><strong>Hello Security Researchers</strong></p> <p>In this writeup I will talk how I was able to find an IDOR in one of the largest Russian Company nothing other than Mail.ru So approaching targets with huge scope can be frustrating sometimes since you don’t know where to start, For me I started looking in the main scope of <code>Mail.ru Games</code></p> <ol> <li>I fired up Burp</li> <li>Created an account</li> <li>Adding things in my cart</li> <li>Viewing the <code>blog</code></li> <li>Creating a support ticket</li> </ol> <p>Before testing anything the ticket link looked kind of suspicious since it had <code>/ticket/INTEGER</code></p>