hunt-write-gap

To test APIs for unauthorized write access, execute PATCH, POST, and DELETE requests against protected resources using curl, then manually verify HTTP response codes to confirm successful unauthorized modifications.

An IDOR write vulnerability allows authenticated users to modify resources belonging to other users. You can detect this IDOR write vulnerability by attempting cross-user PATCH or POST modifications and checking for successful response codes.

Yes, you can audit Supabase and Firebase backends for unauthorized write operations by testing common write methods against discovered endpoints to confirm accessibility and validate if users can modify sensitive fields like roles or balances.

Yes, you need curl installed to execute HTTP requests when checking for GraphQL API write flaws, as the testing process requires sending PATCH, POST, and DELETE methods against protected resources and manually verifying the responses.

Privilege escalation testing for SaaS platform APIs validates if authenticated users can modify sensitive fields like user roles or subscription tiers by sending unauthorized write requests and confirming the modifications were successful.

The limitation of detecting unauthorized write access manually is that it requires manual verification of HTTP response codes after executing curl requests, meaning you must individually inspect each response to confirm a successful unauthorized modification.