Tanuki

Today's study session with Tanuki might get interesting due to the hint IDOR

If I'm hunting for an IDOR, I go to my Burp after clicking around for a while. When I see a ID in an URL, especially when it's a predictable ID, I'll usually try IDOR and SQLi.

When going through the traffic, I noticed /api/stats/4 , so naturally I tried changing the 4 to a 5.

Nice and easy win today! Got to see someone else's stats and my flag 🇧🇪