Part I: Bug Bounty Hunting for IDORs and Access Control Violations

Authenticated Testing on Starbucks' public bug bounty program on HackerOne, searching for IDORs and Access Control violations. 00:00 - IDOR vs Access Control Violation 07:29 - Choosing a Program 09:55 - Taking Notes is Mandatory 12:06 - Registering Accounts 18:59 - Locating Attack Vectors in Cookies 25:31 - Identifying Important Cookies 26:45 - How to Use Pointers 28:30 - Testing for IDORs in JWTs 39:14 - Identifying Mechanisms 46:40 - Avoiding False Positives 57:11 - Identifying Objects 1:00:14 - Testing for IDORs in APIs 1:10:30 - Grouping Mechanisms By Client ID Process 1:23:01 - Best-Case Scenario for IDORs Hire Me! - https://ars0nsecurity.com Watch Live! - https://twitch.tv/rs0n_live Free Tools! - https://github.com/R-s0n Connect! - https://www.linkedin.com/in/harrison-richardson-cissp-oswe-msc-7a55bb158/