Port 22

Account takeover using IDOR and the misleading case of error 403.