I’m Helmi Riahi — a network & systems security engineer who gets weirdly excited about pentesting . Today I want to share a crazy little IDOR I found while hunting . This is my first article, so if I screw something up, blame the coffee and DM me on Linked in or drop a comment.
No more chit-chat — let’s jump straight into the bug hunt! 😉

I picked a target (let’s call it target.com), quickly created one test account, verified it, and was ready to start poking around.

While I was scrolling around the site with my account, poking and managing things to see how it behaved, I started wondering if there might be an XSS hiding somewhere. There was a little form to change your display name, and the front page cheerfully said “Bonjour <your name>” — which immediately made me think, hmm… what if I could inject something into that name field?

I tried that — pasted a bunch of XSS payloads into the name field, but nothing worked. I even tried different payloads in another form, still nothing — zilch. Each failed attempt just made the challenge itchier; my ego kept whispering, “You’re missing something,” and that little voice pushed me to dig deeper.

I tried several tools — Acunetix, OWASP ZAP, and a few others — but none of them found a single vulnerability. At that point, I shrugged and thought, “Alright, time to roll up my sleeves and do this the old-fashioned way: manually.”

After logging in, the site first displayed “Login successful” without showing my name next to “Bonjour.” Then, after refreshing, it displayed “Login successful” again — but this time it showed “Bonjour Helmi.” That little inconsistency felt messy to me, like something wasn’t lining up properly. I started thinking: if the site can’t even consistently show my own name, maybe there’s a subtle flaw hiding under the hood — and that’s exactly the kind of clue a careful hunter shouldn’t ignore.

I opened Burp Suite to see exactly what was happening under the hood. After that first “Login successful” message, I captured the request — it looked like this:

That’s when it hit me — I started thinking the server wasn’t actually verifying the token properly. Instead, it seemed to just grant access based on whatever username was in the login field.

So I decided to test my theory: I changed the login field to the word admin.

and booooom !

In the end, the company recognized it as a critical vulnerability, and I received the bounty reward.

Thanks for following along!