Just change the number
If record 2 is yours, what's record 1? Change the id and find out:
curl -s 'http://127.0.0.1:8080/app/note?id=1'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/note?id=1' [admin] Admin private note. Do not share: vulntech{idor_read_anyones_note}
That's the admin's private note — and it contains a flag. You read it with no login and no permission. This is an Insecure Direct Object Reference (IDOR): the app trusts a user-supplied id to point at a record but never checks that the requester is allowed to see it.
Tip: IDOR hides anywhere an id, filename or account number appears in a URL, form field, cookie or JSON body. Numeric ids are the easiest to walk.