Hunt Idor

Crown Jewel Targets

Why IDOR pays big:

• Direct access to other users' data without authentication bypass, clear, demonstrable impact
• Chains easily with privilege escalation, financial fraud, and account takeover
• Affects virtually every application with user-owned resources

Highest-value asset types (by payout potential):

Asset Type	Why It Pays
Financial documents / billing APIs	PII + financial data exposure (Shopify, Uber, PayPal)
Private repositories / source code	IP theft, critical data loss (GitHub)
User messages / DMs	Privacy violation at scale (Reddit)
Account management endpoints	User addition, deletion, privilege escalation (PayPal, Mozilla)
Business/org administration	Cross-tenant escalation, employee PII (Uber)
Content moderation/admin actions	Operational sabotage (Reddit mod logs)

Programs that pay most for IDOR:

• Platforms with multi-tenancy (SaaS, B2B tools)
• Fintech and payment processors
• Social platforms with private content
• Developer tools with org/repo isolation

---

Attack Surface Signals

URL patterns that scream IDOR:

/api/v1/users/{id}/
/api/v*/orders/{order_id}
/invoices/download?id=
/reports/{uuid}/
/messages/{thread_id}
/admin/orgs/{org_id}/members
/migration/{migration_id}/files
/graphql (query params with IDs)
/api/business/{business_id}/
/vouchers/{voucher_id}/policy

Response header signals:

• Content-Type: application/json on endpoints accepting raw IDs
• No X-Frame-Options or CORS misconfigs paired with ID params
• Authorization: Bearer tokens that are user-scoped but hit org-level resources

JavaScript source patterns:

// Look for hardcoded or interpolated IDs in JS
fetch(`/api/v1/users/${userId}/profile`)
axios.get('/invoices/' + invoiceId)
graphql query { billingDocument(id: $docId) }
// Redux/state stores exposing foreign IDs
state.currentUser.organizationId