A Django-based vulnerable lab built to simulate real-world IDOR scenarios — not just textbook examples.

If you've spent any time in Bug Bounty hunting or penetration testing, you've probably encountered the same frustrating cycle:

Find a vulnerable lab online.

Get excited.

Realize it's overly simplistic, outdated, or completely divorced from reality.

The problem with most vulnerable-by-design applications is that they teach vulnerabilities in isolation. You learn what an IDOR is, sure — but not how it manifests inside a messy, multi-user, production-like application with actual business logic.

That's exactly why IDOR Lab exists.

What is IDOR Lab?

IDOR Lab is an open-source training platform built with Django and TailwindCSS.…