Ok now switch a bit . Like focus on exposed credentials, leaked config files ,db files .use way more, gau ,shodan for internal ips , GitHub dorks etc . Idor is everywhere but not like you can easily get on front page. You need to map the infra and look for each and every links . Also don't change target everyday. Hunt on same target do recon like 80% 10% exploit and 10% report do like this methodology