hunt-idor

## Crown Jewel Targets **Why IDOR pays big:** - Direct access to other users' data without authentication bypass — clear, demonstrable impact - Chains easily with privilege escalation, financial fraud, and account takeover - Affects virtually every application with user-owned resources **Highest-value asset types (by payout potential):** | Asset Type | Why It Pays | |---|---| | Financial documents / billing APIs | PII + financial data exposure (Shopify, Uber, PayPal) | | Private repositories / source code | IP theft, critical data loss (GitHub) | | User messages / DMs | Privacy violation at scale (Reddit) | | Account management endpoints | User addition, deletion, privilege escalation (PayPal, Mozilla) | | Business/org administration | Cross-tenant escalation, employee PII (Uber) | | Content moderation/admin actions | Operational sabotage (Reddit mod logs) | **Programs that pay most for IDOR:** - Platforms with multi-tenancy (SaaS, B2B tools) - Fintech and payment processors - Social platforms with private content - Developer tools with org/repo isolation --- ## Attack Surface Signals **URL patterns that scream IDOR:** ``` /api/v1/users/{id}/ /api/v*/orders/{order_id} /invoices/download?id= /reports/{uuid}/ /messages/{thread_id} /admin/orgs/{org_id}/members /migration/{migration_id}/files /graphql (query params with IDs) /api/business/{business_id}/ /vouchers/{voucher_id}/policy ``` **Response header signals:** - `Content-Type: application/json` on endpoints accepting...