Invoice No. 1042

Welcome to this intentionally vulnerable training application.

Objective: IDOR / broken object-level authorization. Inspect requests and responses with Burp Suite or browser developer tools. Use only the synthetic accounts and data supplied here.

Do not attack the arena portal or any system outside this lab.

Starting point: Inspect invoice IDs