Data exposure exploitation and impact amplification - IDOR, excessive data in API responses, mass PII exfiltration, and severity escalation. ALWAYS invoke when: API returns more fields than UI shows, found access to another user's data, need to prove impact from any auth bypass or injection, user says 'prove impact' or 'what can I access'. This skill turns Medium findings into Criticals.
| Industry | Look for (T1/T2) | Best vector |
|---|---|---|
| Fintech | Account numbers, card data, transactions | Account endpoint IDOR, export features |
| Healthcare | Medical records, prescriptions | Patient ID IDOR, report downloads |
| HR / payroll | SSN, salary, bank details | Employee ID IDOR, payroll export |
| E-commerce | Card data, order history, addresses | Order ID IDOR, account IDOR |
| SaaS / B2B | API keys, internal docs, business data | Org/workspace IDOR |
| Social | Private messages, location, photos | Message/media IDOR |
API style determines approach:
Find the pagination count field (needed for mass exposure proof):
total, count, meta.total, x-total-count header, recordCount
Which pattern are you seeing?
| Tier | Data | Severity |
|---|---|---|
| T1 | SSN, financial accounts, medical records, full cards, password hashes | Critical |
| T2 | Email + DOB + address combined, passport, private messages, location history | High |
| T3 | Email, phone, name + employer | Medium |
| T4 | Username, public profile, preferences | Low / Informational |
Always push to find the highest-tier data accessible. Same vuln at T1 vs T4 is a completely different finding.
ssn, dob, password_hash, internal_id, admin_notes, credit_card_last4, phone, ip_address, location, apiKey, role?limit=10000 to any paginated endpoint. Does it return all records?/api/export/users, /api/reports/download, /api/downloadGET /api/search?q= - returns all results?GET /api/users/suggest?q=a - enumerates user base?Safe PoC (do NOT dump the database):
Request page 1 and page 2. Note the total count in the response. Report: "Endpoint returns total: 847,293 - this represents the total accessible user records."
Found mass exposure? This is the severity amplifier. Single-user IDOR = Medium. All-user IDOR = Critical.
Severity formula:
Base: IDOR or excessive exposure = Medium
+ T1 data (SSN, card, medical) = Critical
+ No auth required = +1 severity
+ Mass exposure (all users) = +1 severity
+ Enables account takeover = Critical regardless
Chaining decision tree:
Evidence required:
Frame it as: "IDOR in /api/user/{id} allows any authenticated user to access full profiles including ssn, dob, home_address for all 2.3M users. No rate limiting. Enables identity theft at scale."
NOT: "The endpoint returns data for other users."
1, 2, 3. Other users' data? Step 2.?limit=1000 to paginated endpoints. All records? Step 4./api/admin/, /api/internal/, /api/v1/users. No auth needed? Finding./api/export, /api/download. Bulk data? Step 4.Nothing after all five? Move on.
If enumeration is blocked:
GET /export/invoice/12345.pdf/api/billing/invoices/ID/api/attachments/ID/download/api/admin/users/ID/api/v1/users/ID unprotected while v2 is guarded/api/messages/thread/ID/read| Framework | Where IDOR hides |
|---|---|
| Rails | Missing authorize call - test edit, update, destroy, export actions |
| Django DRF | queryset = Model.objects.all() without user filter - test every RetrieveAPIView |
| Spring Boot | @PreAuthorize checks role not ownership - test all GetMapping with ID params |
| Express | findById without user filter - test every ID param endpoint |
| FastAPI | Token validated but DB query not scoped - test every ID path param |
Cryptographic IDOR - IDs that look random but are not:
hashids librarypython3 references/idor_enum.py \
--url "https://api.target.com/documents/{id}" \
--auth "Bearer YOUR_TOKEN" \
--start 1 --end 5000 --your-id 4521 --delay 0.5 --out results.json
references/idor-patterns.md — IDOR techniques, array wrapping, bypass patterns, horizontal-to-vertical chainreferences/api-exposure.md — GraphQL introspection, REST hidden fields, SSPP, access control bypassreferences/mass-exposure.md — Safe mass enumeration, scale calculation, severity escalation, report framingreferences/advanced-patterns.md — WebSocket IDOR, CSWSH, race condition IDOR, GraphQL advanced, mobile APIsreferences/framework-idor.md — Framework-specific IDOR (Rails, Django, Spring, Express, FastAPI), cryptographic IDOR, gRPC patterns, idor_enum.py script