Easy IDOR hunting with Autorize? (GIVEAWAY)

I've said it once and I'll say it again APIs are some of the best applications to hunt on, and now I've worked at a platform I have some data to back me up that IDORs are fantastic first bugs and they are EVERYWHERE! But, when we test a real API vs a lab or CTF there are so many endpoints and resources and stuff to test, so what if we could make IDOR hunting easier? What if we could automate it? Well this is what Autorize is designed to do! This free Burp extension allows us to automatically make a second request to test if our attacker account can do something to affect our victim. It's such a useful tool to have installed I 100% recommend it especially if you're a beginner.

This month as a thank you for bearing with me as I get back into video making we're doing a giveaway! To win one of the following prizes please enter via a comment on this video with an answer to: What bug or type of hacking do you want to know more about? And the text: #bountypls

5x 1 month memberships PentesterLab Pro
5x 2 months Try Hack Me Premium
10x InsiderPhD Swag Pack

[dhruvkandpal]

Great video, Katie! Loved it as always.
My favourite bug bounty tools are burp suite, all tomnomnom's tools, amass and the ones I developed on my own! (LazyFuzzZ, Wordlist Weaver, Fu-JS) #bbhammer

[stablewater]

Thanks for this great knowledge. I am currently learning IDOR and I've been able to use autorize and I got "enforced" in some areas. What next am I to do next. How do I exploit this for bug bounty?

[Vinayak-qp]

amazing, this could be probably one of the biggest information that i have ever been given

[Coollinux-cb]

21:24 what idor it's called?, is it idor?

[gf]

Awesome video, as always!

Favourite tool - Burp Suite - even if the only features it had were the proxy history and Repeater, it'd still be amazing.

##bbhammer

[CyberTron]

Thanks for doing so much for the community ❤️
It'll be great to have more videos about DOM based vulnerabilities #bountypls

[gk_eth]

Mostly there r auth bearer token for APIs which also needs to be add in cookies section?

[arrheniusangipaelongan]

Thanks for all your videos Katie!❤ I got my first bug from your IDOR video. My favorite tool is burp! #bbhammer

[link-ed]

Thanks for the video! The tool that I use the most is fuff, cause of it's speed and simplicity. Burp is another indispensable tool as well! #bbhammer

[sekmekci]

Thanks for the video. Information part is starting at 3:49

[sudokom]

My favourite bugbounty tools are FFuF, Dirsearch, and Burpsuite with this extentions such as autorize #bbhammer

[maapi]

I'm having an issue with autorize picking up requests that should be out of scope. Anyone else have this issue? This leads to a lot of extra requests to parse through, which really slows me down

[chitraa]

Thanks for doing amazing video katie. My fav bug bounty tool is burp ofcourse. I'm looking forward more automation videos like this..#bbhammer

[xff]

why you're so late katie. i was waiting for this video for so long

[rami]

Thanks for all your videos Katie, My favorite tool is burp #bbhammer .

[saite]

nice video i've watched quite a few of em. clear well rehearsed script.. this video actually tries to show us something. well rounded video.
i wish more of your videos showed us how to actually do this stuff like this video. you do great on the speaking side of teaching tho, need more hands on tho.

[sangeethaa]

I want more videos explaining bugs with dem websites not just presentations. Thank You, Katie. #bountypls #bbhammer

[roxneil]

katie, i'm new to bug hunter, i'm still practicing about the web security system, i have joined in ingriti but i don't know what i can and can't do when looking for bugs, can you give a little direction and tips on how to work in intigriti please, ,

[iamkaustubh]

Wowww Thanks katie 🔥🔥🔥🔥it really encourages people more thanks for video

[Death_User]

You are my favorite bug bounty channel