WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Oct 12, 2020

How to Cause (or Prevent) a Massive Data Breach- Secure Coding and IDOR

Anna Bacher

Could a simple URL tweak expose your database? IDOR vulnerabilities routinely cause massive enterprise data breaches. Learn to systematically eradicate these flaws using AI-driven secure coding.

Pause
Mute Enter Fullscreen
#1 about 4 min

Introduction to insecure direct object reference vulnerabilities

How software vulnerabilities like IDOR enable massive data breaches by breaking access controls.

#2 about 3 min

Real-world business consequences of IDOR vulnerabilities

Why IDOR exploitation causes severe business consequences like account takeovers and heavy financial penalties.

#3 about 2 min

Mechanisms of exploiting IDOR through URL manipulation

How attackers gain unauthorized access to sensitive documents by simply incrementing ID numbers in web requests.

#4 about 4 min

Setting up a penetration testing environment for web apps

To safely demonstrate web application vulnerabilities, developers can prepare an environment using Kali Linux and Burp Suite.

#5 about 5 min

Exploiting e-commerce basket identifiers with Burp Suite

Attackers can intercept and manipulate API requests using Burp Suite to access other users' shopping baskets without authorization.

#6 about 7 min

Modifying user product reviews via IDOR vulnerability exploitation

Modifying user identifiers in intercepted HTTP requests allows attackers to impersonate users and alter product reviews.

#7 about 3 min

Reviewing high-profile IDOR vulnerabilities found on HackerOne

Analyzing real IDOR exploits in major platforms reveals how simple API oversight leads to massive account takeovers.

#8 about 2 min

Challenges of systematically defending enterprise code against IDOR

Because traditional mitigation strategies rely heavily on manual access controls, they often fail to protect enterprise codebases.

#9 about 7 min

Detecting complex IDOR vulnerabilities using code property graphs

Analyzing source code through multi-graph structures helps developers identify complex IDOR patterns with fewer false positives.

#10 about 3 min

Limitations of CodeQL for accurate IDOR vulnerability detection

Standard semantic query tools often miss critical vulnerabilities by relying too heavily on rigid variable naming conventions.

#11 about 5 min

Improving detection and automated patching with neural networks

Training neural networks on code property graphs empowers developers to automatically detect vulnerabilities and generate authorization patches.

Matching moments

5:30 min

Identifying non-coding software vulnerabilities and organizational risks

Tino Sokic · World Congress 2023

2:55 min

Identifying common and emerging application injection attack vectors

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

3:06 min

Transitioning from code risks to data-driven business threats

Jon Geater · World Congress 2023

1:08 min

Mitigating AI code risks and OWASP recommendations

Liran Tal Liran Tal · LIVE

2:10 min

Examining common exploitation techniques against software organizations

Vandana Verma · LIVE

4:48 min

Using intentionally vulnerable applications for practical security training

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

More from WeAreDevelopers LIVE

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
7 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
12 days ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers - Of Agents and Robots thumbnail
1:04:42
13 days ago

WeAreDevelopers - Of Agents and Robots

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers LIVE - How DevRel Makes Tech More Human thumbnail
48:06
20 days ago

WeAreDevelopers LIVE - How DevRel Makes Tech More Human

Chris Heilmann, Daniel Cranney

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres thumbnail
7:41
21 days ago

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres

Chris Heilmann, Daniel Cranney

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
about 1 month ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 24, 2026 · 14:10–14:40

Stage 2

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

September 25, 2026 · 11:00–11:30

Stage 6

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

September 25, 2026 · 13:30–14:00

Stage 9

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

September 25, 2026 · 09:00–09:30

Stage 4

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans
Open session

World Congress 2026 North America

September 24, 2026 · 12:15–12:45

Stage 6

AI vs. AI: Defending the open source supply chain with agentic workflows

Manfred Moser

Senior Principal DevRel Engineer at Chainguard

Manfred Moser
Open session

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen

Related videos

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 6 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Can Machines Dream of Secure Code? Emerging AI Security Risks in LLM-driven Developer Tools thumbnail
35:37
LIVE • almost 2 years ago

Can Machines Dream of Secure Code? Emerging AI Security Risks in LLM-driven Developer Tools

Liran Tal

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most thumbnail
24:33
World Congress 2026 Europe • about 2 months ago

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • about 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks thumbnail
27:10
World Congress 2023 • almost 3 years ago

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.