> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/idor-insecure-direct-object-reference/copypasta.md).

# CopyPasta

Level: Easy\
Points: 10\
Type: Daily Challenge

Lab Interface

<figure><img src="/files/y5sPBCMbkUWKa1JcbehA" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/MnvjK5g4qXqHzFtpNTYJ" alt=""><figcaption></figcaption></figure>

We have option to create new snippet

<figure><img src="/files/DCJJJ8JvTr2aD5AV8zmN" alt=""><figcaption></figcaption></figure>

Key thing here is the ability to make our new snippet private/public. This feature gives us idea about possible IDOR vuln.

To check this, I created another account. In the 1st account I created a private snippet and from 2nd account I was able to view it.

<figure><img src="/files/E9SU0t3BDiVQRyB99Vpk" alt=""><figcaption></figcaption></figure>

```
bug{8i9A3cgr4kq2FOgDGGjhBKcayrZUuhsS}
```
