IDOR

1. Create two accounts, swap API parameters, and try to access information from each other.

2. Sending a GET request does not imply the ability to perform POST or update actions; hence, it's essential to experiment with various request types on the same API.

3. Param pollution

4. https://jasper-join-7e5.notion.site/IDOR-Cheat-Sheet-9f7c9e3285bf4c7cae5ea38243cd0391