Today's quest · Public
+ 250 RP · $50 bonusFind an IDOR in any open program before 23:59 UTC.
Insecure Direct Object References hide in plain sight. Today's hint: sequential IDs in API responses that shouldn't be guessable. Sort orders matter. Check PDF generators.
1,841 attempts · 3 winners14h 32m left
Submit your writeup
Recent quests
Stored XSS in a markdown field
Yesterday
Auth bypass via stale JWT
2d ago
SSRF in image-upload service
3d ago
Open redirect chained to CSRF
4d ago