hunt-idor

Create two accounts at the same privilege level, capture User A's object IDs while authenticated, then replay those requests with User B's session token. Test all HTTP verbs (GET, POST, PUT, PATCH, DELETE) and confirm a 200 response containing User A's data proves the IDOR.

Burp Suite captures and replays requests, ffuf enumerates sequential IDs with filtered status codes, and curl performs manual token-swapped tests. JavaScript bundle analysis with grep helps harvest leaked UUIDs and object references.

Yes, GraphQL resolvers often lack field-level authorization. Run introspection to enumerate queries and mutations accepting id arguments, then substitute another user's ID in both read queries and write mutations to test object-level access control.

UUIDs frequently leak in other API responses, notification emails, webhooks, JavaScript source, or GraphQL queries. Harvest victim UUIDs from accessible endpoints, then replay them against restricted endpoints that only check authentication, not ownership.

The most common cause is a 200 response that returns no actual victim data, such as empty arrays or redacted fields. Always confirm the response contains real cross-tenant data and document the exact differential between attacker and victim access.

Severity increases when the IDOR exposes financial data, PII at scale, or chains into state changes like email modification, refunds, or role escalation. A read-only IDOR chained to a password reset or mass-assignment flaw can reach full account takeover.