hunt-idor

1## Crown Jewel Targets
2 
3**Why IDOR pays big:**
4- Direct access to other users' data without authentication bypass — clear, demonstrable impact
5- Chains easily with privilege escalation, financial fraud, and account takeover
6- Affects virtually every application with user-owned resources
7 
8**Highest-value asset types (by payout potential):**
9 
10| Asset Type | Why It Pays |
11|---|---|
12| Financial documents / billing APIs | PII + financial data exposure (Shopify, Uber, PayPal) |
13| Private repositories / source code | IP theft, critical data loss (GitHub) |
14| User messages / DMs | Privacy violation at scale (Reddit) |
15| Account management endpoints | User addition, deletion, privilege escalation (PayPal, Mozilla) |
16| Business/org administration | Cross-tenant escalation, employee PII (Uber) |
17| Content moderation/admin actions | Operational sabotage (Reddit mod logs) |
18 
19**Programs that pay most for IDOR:**
20- Platforms with multi-tenancy (SaaS, B2B tools)
21- Fintech and payment processors
22- Social platforms with private content
23- Developer tools with org/repo isolation
24 
25---
26 
27## Attack Surface Signals
28 
29**URL patterns that scream IDOR:**
30```
31/api/v1/users/{id}/
32/api/v*/orders/{order_id}
33/invoices/download?id=
34/reports/{uuid}/
35/messages/{thread_id}
36/admin/orgs/{org_id}/members
37/migration/{migration_id}/files
38/graphql (query params with IDs)
39/api/business/{business_id}/
40/vouchers/{voucher_id}/policy
41```
42 
43**Response header signals:**
44…