标签：#pentesting

Ultimate IDOR Testing Checklist Phase 1: Setup & Target Identification [ ] Create Test Accounts: Create two accounts (Attacker and Victim) for safe testing of destructive requests (POST/PUT/DELETE). [ ] API Identification: Find JSON endpoints over rendered HTML. [ ] Sensitivity Analysis: Target critical functions first (password reset, account recovery, financial data, DMs, user management). [ ] ID Audit: Check if endpoint is private or public and contains any kind of ID parameter. [ ] ID Leakage: Check for IDs leaked via other API endpoints or public pages (public profile pages, listings). [ ] Map Clients: Collect web/mobile clients, open APIs from decompiled mobile (jadx/apktool), and swagger/openapi if present. Phase 2: Direct ID Substitution & Enumeration Technique Scenario to Test (Attacker ID=10, Victim ID=9) Basic ID Flip GET /api/v5/users/10 -> GET /api/v5/users/9 Incremental Numeric Brute Force Loop over sequential numeric IDs (decrement/increment from own ID). Non-Numeric ID Substitution Replace param with email / username / UUID. Complex ID Brute Force Brute force short alphanumeric segments (last 1–4 chars). Predictable ID / Combined ID /user/2222/data/3333 — change one or both parts. Hashed/Derived IDs (MD5/SHA1 pattern) Detect hashed IDs, create accounts to infer mapping, try replacing derived hashes. Phase 3: Path and URL Manipulation Bypasses Technique Scenario to Test (Attacker ID=10, Victim ID=9) Trailing Slash GET /api/v5/users/9 -> GET /api/v5/users/9/ Double Slashes / Obfuscated Path GET /api/v5/users//9 or GET /api/v5/users/./9 Case Variation / Key Swapping /api/User?id=123 vs /api/user?id=123 or user_id ↔ userid Path Traversal / Mixed Paths POST /users/delete/my_id/../victim_id Wildcard Substitution GET /api/users/* or GET /api/users/user_id Fuzz Keywords in Path GET /api/v3/users/12345 -> /api/v3/users/all SQLi Quick Check GET /api/v3/users/12345' Phase 4: Logic & Endpoint Bypasses Technique Scenario to Test Version Downgrading GET /v3/user/1