Two-account object replay
Capture object IDs as A, replay as B across GET/PUT/DELETE, batch, and GraphQL node(id). The pipeline is a notebook, not a scanner.
Level: intermediate
Tools: Burp Suite, Caido, jq
Pipeline
As user A, save object IDs from {list_url}. As user B, replay each ID on GET then PUT/DELETE. Record status and body deltas only.