hunt-idor

Create two accounts at the same privilege level, capture User A's resource IDs while authenticated, then replay those requests with User B's session token. Test all HTTP verbs (GET, POST, PUT, PATCH, DELETE) and confirm a 200 response containing User A's data.

Run introspection with { __schema { queryType { fields { name } } } } to enumerate queries and mutations accepting id arguments, then substitute another user's ID in each. Relay-style node(id:) resolvers often authenticate the requester but skip ownership checks on nested relations.

Yes, UUIDs only raise the enumeration bar but frequently leak through other API responses, notification emails, webhooks, JavaScript bundles, or GraphQL queries. Harvest leaked UUIDs from accessible endpoints and replay them against restricted ones.

The most common rejection cause is a 200 response that returns no actual victim data, such as empty arrays or redacted fields. Validate the exact differential: confirm the second account has no legitimate access and the response contains real confidential data before filing.

Burp Suite Intruder handles sequential ID fuzzing with response-length filtering, ffuf automates wordlist-based enumeration with status matching, and curl with swapped session tokens performs the core differential test. A simple Python loop generates ID ranges around known values.

Look for state-changing endpoints accepting the same ID: email change plus password reset yields account takeover, refund endpoints yield financial impact, and team membership endpoints with mass assignment yield role escalation. The second half of the chain usually shares the same missing ownership check.