what is iitk_idor_poc fr?

This repository is a public proof of concept documenting a security flaw that was once present in IIT Kanpur's Pingala Application Portal, a system used for handling applications at the institute. The author reports that the issue has already been fixed by the school's IT authority, and this project exists purely to explain, for educational purposes, how the flaw worked. The bug is known as an IDOR, short for insecure direct object reference. In plain terms, the portal's payment process created an order for an applicant using a simple numeric id. Because that id was predictable and not properly checked against who was making the request, someone could change the number and pull up another applicant's order, exposing that person's name, email address, and phone number. The README includes a sample of what leaked data looked like, showing a name, mobile number, and email tied to an id. To use this project, you open it in IntelliJ IDEA, clone the repository, and let Maven install the dependencies listed in the pom.xml file. The main logic lives in a file called Main.java, which contains sample code demonstrating the request pattern. If you want to inspect the network traffic yourself, you can route requests through Burp Suite by setting the ProxySelector in Main.java to point at your local Burp listener, typically at address 127.0.0.1 port 8080. The author is explicit that this is meant as a teaching example for people learning about application security, showing that even large, well funded institutions can ship flawed authorization logic. No warranty or support is offered, and the author states they are not responsible for any misuse, since the flaw has already been reported and resolved.