Inside a Codesnag engagement

One of India's largest hotel chains was losing money through its own booking site. A group had found an Insecure Direct Object Reference in the payment mechanism and was using it to book high-priced rooms and exclusive club events at prices nobody had agreed to. By the company's own account the losses ran past thirty million dollars.

Their internal security team could not find the root cause. That is not a criticism of them — an IDOR does not look like an attack in a log. Every request is well-formed and authenticated. The only thing wrong is which object the identifier points at.

Codesnag's incident responders and founders came in and worked both halves at once: neutralise the exploit, and trace who was using it. Both were done inside a week, using offensive methodology rather than log review, because the fastest way to find what an attacker is doing is to do it yourself.

The engagement did not end at the fix. VAPT reporting re-secured the site and the payment gateway, and the chain moved to regular assessments rather than waiting for the next incident to reveal the next one. That shift — from responding to watching — is the actual deliverable.