Tales from the Trace: Finding IDORs with Agentic Reasoning
Join XBOW’s Offensive Security Engineers for a deep, trace-level walkthrough of how real Insecure Direct Object References (IDORs) are discovered and exploited in practice, using two 0-day vulnerabilities found in the Spree eCommerce framework.
In this recorded webinar, we’ll show how XBOW’s IDOR module reasons about authorization boundaries where traditional scanners stop at linear checks and error responses.
What you’ll learn:
Two real Spree zero-day IDORs: unauthenticated and cross-cart billing/shipping address access, walked through trace by trace.
Why scanners fail at IDORs: linear ID probing and response diffing break as soon as authorization logic and state come into play.
How XBOW finds them instead: agentic reasoning over objects, roles, and auth states, with access to real data.
Speakers
Offensive Security Engineer @ XBOW
Offensive Security Engineer | XBOW @ XBOW
Related Resources
How Moderna is Rethinking Security Testing in the Age of Autonomous and AI-Driven Attacks
Nico Waisman
Autonomous Offensive Security at Scale: Modern Penetration Testing for Enterprises
Loi Liang Yang
