IDOR and broken authorization

Playbooks

• IDOR & Broken Access Control - Systematically test whether one user can reach another user's objects or actions.
• CORS Misconfiguration - Abuse permissive cross-origin policies to read authenticated responses from a victim's browser.
• GraphQL Abuse - Enumerate and attack GraphQL: schema recovery, authorization gaps, and resource abuse.
• WebSocket Hunting - Treat the socket as an API with a worse auth story. Handshake, first message, then every subscribe.
• Firebase / Supabase Apps - The API key is supposed to be public. The bug is the rules, the open signup, and the data.
• Advanced JavaScript Analysis - Turn shipped JavaScript into a bounded, evidence-led map of client attack paths: collect only in-scope artifacts, recover source where exposed, trace controllable data to real sinks or authorization decisions, then validate the smallest safe chain.

Gadgets

• IDOR parameter - The param is inventory until you prove a second user can read or write the object.
• WebSocket IDOR / missing auth - Subscribe to another user's channel, replay a privileged event, or skip the HTTP auth that the REST API has.
• GraphQL node(id) / alias batch - Relay-style node(id) and aliased batch queries skip the UI's object graph. Same as IDOR, with a nicer query language.

Payloads

• GraphQL - Start with introspection to dump the schema; if it's off, use field-suggestion errors (clairvoyance) to rebuild it. Then hunt BOLA/BFLA on objects and mutations.
• WebSocket - Handshake and first-frame probes. Swap in a victim cookie / Origin to test CSWSH and channel IDORs.
• Mass assignment - Extra keys on register / PATCH / GraphQL update. Prove the new field changes authz, not just the JSON echo.
• IDOR / object-ID canaries - Two-account object identifiers and verb swaps. Use records you created. The payload is the ID, not a dump.

Bypasses

• 403 / Access-control bypass - When a path returns 401/403, try to reach it another way. Path-normalization disagreements between the edge (Nginx/HAProxy/CDN) and the app, plus trusted-header quirks, are the reliable wins on modern stacks.
• GraphQL authorization and batching - UI hide is not schema hide. Aliases, batch, and node(id) skip the screen the designer drew.
• IDOR object and verb swap - Two accounts. Every verb. Hidden fields and batch IDs are the usual miss.

Checklists

• Authorization / IDOR - If you only have one account you are guessing. Two accounts is the test.
• API / GraphQL - The UI is a subset of the schema. Hunt the schema.
• GraphQL - The schema is the app. Introspection off just means you reconstruct it.
• WebSockets - Handshake, first frame, then every subscribe. Treat it as an API with a worse auth story.

Workflows

• Two-account object replay - Capture object IDs as A, replay as B across GET/PUT/DELETE, batch, and GraphQL node(id). The pipeline is a notebook, not a scanner.

Questions

What if IDs are UUIDs?

UUIDs are still IDORs if you can obtain them from exports, websockets, search, or another object graph. Sequential is easier, not required.

GET is locked. Am I done?

Try PUT, PATCH, DELETE, and batch on the same object. Function-level authorization (BFLA) is the usual miss.

This page is the public form of hunt_brief("idor") on the MCP connector. Authorized testing only.