# IDOR

1. Create two accounts, swap API parameters, and try to access information from each other.
2. Sending a GET request does not imply the ability to perform POST or update actions; hence, it's essential to experiment with various request types on the same API.
3. Param pollution
4. <https://jasper-join-7e5.notion.site/IDOR-Cheat-Sheet-9f7c9e3285bf4c7cae5ea38243cd0391>
