I recently found an Insecure Direct Object Reference (IDOR) vulnerability in a web application that I was testing. By incrementing or decrementing an ID value, I could download any file in the application, even though they were not listed for download in the user interface. A simple way to exploit this kind of attack is…