▸case-14 An API endpoint processes bulk requests using JSON arrays: `POST /api/export` with payload `{"doc_ids": [501, 502]}`. User A owns document 501 but not 502. What specific behavior indicates a broken object level authorization defect in batch processing? | pass→pass | 10,806 | 8,543 | -21% | 1 | 1 | 0% | 1,651 | 2,430 | +47% | 0 | 0 | — |
▸case-01 When testing a REST endpoint `/api/v1/invoices/1001` for unauthorized access to other users' invoices, security engineers often consider automated brute-force tools. If the application returns 403 Forbidden on sequential IDs like `1002`, what proxy tool configuration strategy should be tested first to rule out session-token binding versus object-level access control? | pass→pass | 15,429 | 22,444 | +45% | 1 | 1 | 0% | 2,553 | 3,024 | +18% | 0 | 0 | — |
▸case-02 A web application allows updating profile addresses via `POST /api/user/update` with a payload `{"user_id": "554", "street": "123 Main St"}`. A tester attempts to modify another user's address by changing `user_id` to `555`, but receives a `200 OK` response without seeing changes reflect on user 555's profile. How should the tester verify whether an IDOR actually occurred? | pass→pass | 14,946 | 14,472 | -3% | 1 | 1 | 0% | 2,537 | 3,301 | +30% | 0 | 0 | — |
▸case-03 An internal web portal exposes uploaded PDFs via direct URL path `https://portal.example.com/static/receipts/2023/REC-00891.pdf`. What method effectively determines whether this static resource endpoint suffers from an authorization bypass vulnerability? | fail→fail | 17,754 | 24,031 | +35% | 1 | 1 | 0% | 1,816 | 3,358 | +85% | 0 | 0 | — |
▸case-04 An API uses path parameter object references formatted as v4 UUIDs, such as `/api/v1/documents/f47ac10b-58cc-4372-a567-0e02b2c3d479`. A developer claims UUIDs make IDOR testing impossible due to lack of sequential predictability. How should an appsec tester evaluate IDOR exposure despite non-sequential identifiers? | pass→pass | 16,705 | 18,098 | +8% | 1 | 1 | 0% | 2,662 | 3,775 | +42% | 0 | 0 | — |
▸case-05 While analyzing an API that controls order management, changing `account_id` allows viewing other standard users' orders. What specific parameter manipulation pattern should be attempted next to test for vertical privilege escalation? | pass→pass | 12,061 | 15,126 | +25% | 1 | 1 | 0% | 1,921 | 3,066 | +60% | 0 | 0 | — |
▸case-06 During automated HTTP request enumeration for object IDs, the application server returns `429 Too Many Requests` after 50 attempts. What request header manipulation or proxy adjustment should be tried to test if rate limiting is loosely implemented? | pass→pass | 13,973 | 10,839 | -22% | 1 | 1 | 0% | 2,520 | 2,871 | +14% | 0 | 0 | — |
▸case-07 A developer needs to fix an IDOR vulnerability where database primary keys like `customer_id=1492` are exposed in web forms. Rather than performing raw database ID lookups, what architectural pattern maps session-specific temporary keys to real internal identifiers? | pass→pass | 9,692 | 19,611 | +102% | 1 | 1 | 0% | 1,647 | 4,372 | +165% | 0 | 0 | — |
▸case-08 A backend service checks if a request contains a valid JWT before serving requested document IDs. However, users can still view other users' documents. What missing backend validation step must be implemented to remediate this vulnerability? | pass→pass | 5,433 | 6,205 | +14% | 1 | 1 | 0% | 958 | 1,950 | +104% | 0 | 0 | — |
▸case-09 When configuring Burp Suite Intruder to test an endpoint `/api/documents?id=100` across a range of 1000 sequential integers while maintaining an active session, which Intruder payload type and setting avoids triggering invalid session errors due to stale tokens? | pass→fail | 11,622 | 15,813 | +36% | 1 | 1 | 0% | 2,115 | 2,761 | +31% | 0 | 0 | — |
▸case-15 An application fetches user reports via `GET /download?filename=user_102_report.pdf`. An attacker changes the parameter to `filename=user_103_report.pdf` and downloads another user's file. Is this vulnerability classified primarily as Directory Traversal or IDOR? | pass→pass | 7,057 | 6,298 | -11% | 1 | 1 | 0% | 1,073 | 1,957 | +82% | 0 | 0 | — |
▸case-10 During bulk ID enumeration, all HTTP response status codes return `200 OK`. How should the analyst identify true positive IDOR exposures from false positives in the intruder results? | pass→fail | 13,845 | 13,782 | -0% | 1 | 1 | 0% | 2,608 | 3,664 | +40% | 0 | 0 | — |
▸case-11 An endpoint `/api/account` accepts JSON bodies. The original request is `{"id": 101, "action": "view"}`. When changing `101` to `102` returns a `403 Forbidden`, what parameter duplication technique can be used to bypass simplistic JSON parser checks? | pass→fail | 22,483 | 18,624 | -17% | 1 | 1 | 0% | 1,649 | 2,843 | +72% | 0 | 0 | — |
▸case-12 A modern web application utilizes GraphQL endpoints like `query { node(id: "VXNlcjoxMDI=") { name email } }`. How should a security tester analyze the object reference payload for potential IDOR? | pass→pass | 15,981 | 14,238 | -11% | 1 | 1 | 0% | 2,849 | 3,359 | +18% | 0 | 0 | — |
▸case-13 A GET request to `/api/v1/orders/8812` yields `403 Unauthorized` when accessed by a non-owner. What HTTP method verb modification should be tested to evaluate potential access control bypasses? | fail→fail | 19,639 | 21,212 | +8% | 1 | 1 | 0% | 2,281 | 2,795 | +23% | 0 | 0 | — |
▸case-16 An API relies on a custom header `X-User-Id: 4410` alongside a standard Bearer token to route requests. What request manipulation strategy tests for header-based IDOR? | fail→fail | 12,223 | 11,379 | -7% | 1 | 1 | 0% | 1,781 | 2,661 | +49% | 0 | 0 | — |
▸case-17 An API endpoint uses nested resource paths: `/api/organizations/12/projects/99`. Account A belongs to organization 12, but project 99 belongs to organization 13. If Account A accesses `/api/organizations/12/projects/99` and successfully views project 99, what core flaw is present? | pass→pass | 7,292 | 6,988 | -4% | 1 | 1 | 0% | 1,278 | 2,226 | +74% | 0 | 0 | — |
▸case-18 A security analyst notices that entering `' OR 1=1 --` into a search input field `/api/search?q=test` returns all database records across all users. What vulnerability class does this specific payload and result represent? | pass→pass | 6,655 | 5,008 | -25% | 1 | 1 | 0% | 974 | 1,839 | +89% | 0 | 0 | — |
▸case-19 A web application allows updating email addresses via `POST /account/email` using session cookies, but does not validate anti-forgery tokens. An attacker crafts an external HTML page that submits a form to this endpoint when visited by a victim. What primary vulnerability class is being exploited here? | pass→pass | 4,541 | 13,842 | +205% | 1 | 1 | 0% | 755 | 1,810 | +140% | 0 | 0 | — |
▸case-20 An application setting allows users to supply a custom webhook URL `https://user-domain.com/callback`. The server accepts `http://169.254.169.254/latest/meta-data/` and returns cloud instance metadata. What vulnerability class is demonstrated here? | pass→pass | 5,582 | 7,734 | +39% | 1 | 1 | 0% | 799 | 2,014 | +152% | 0 | 0 | — |
▸case-21 In a multi-tenant SaaS application, changing `tenant_id=tenant_a` to `tenant_id=tenant_b` in request query parameters allows viewing tenant B's internal configuration. What specific operational impact rating does this cross-tenant exposure warrant? | pass→pass | 12,168 | 9,134 | -25% | 1 | 1 | 0% | 1,923 | 2,428 | +26% | 0 | 0 | — |
▸case-22 When testing an endpoint for authorization flaws, a tester attempts to change the `sub` claim in a JWT token from `usr_123` to `usr_456`. The server rejects the modified token with `401 Unauthorized`. Is this endpoint vulnerable to standard parameter manipulation IDOR via token forgery? | pass→pass | 9,786 | 7,607 | -22% | 1 | 1 | 0% | 1,618 | 2,235 | +38% | 0 | 0 | — |