IDOR (BOLA) vulnerability search

You usually start with pentest by trying passwords from some service (brute force) and searching for XSS by adding <img src=x onerror=alert('XSS');> to the fields.

But the best place to start is with IDOR (BOLA). This vulnerability is very simple and is often found in different services. We will learn how to do it in this tutorial.