I Find IDOR Bugs in Minutes Using This Simple Manual Trick

1. Create two accounts if possible or else enumerate users first.
2. Check if the endpoint is private or public and does it contains any kind of id param.
3. Try changing the param value to some other user and see if does anything to their account.
4. Done !!

GET /api/MyPictureList → /api/MyPictureList?user_id=<other_user_id>
Pro tip: You can find parameter names to try by deleting or editing other objects and seeing the parameter names used.

Instead of this:
GET /api/albums?album_id=<album id>
Try This:
GET /api/albums?account_id=<account id>
Tip: There is a Burp extension called Paramalyzer which will help with this by remembering all the parameters you have passed to a host.

Instead of this:
GET /api/account?id=<your account id> →
Try this:
GET /api/account?id=<your account id>&id=<admin's account id>
Tip: This is known as HTTP parameter pollution. Something like this might get you access to the admin’s account

Instead of this:
POST /api/account?id=<your account id> →
Try this:
PUT /api/account?id=<your account id>
Tip: Try switching POST and PUT and see if you can upload something to another user’s profile. For RESTful services, try changing GET to POST/PUT/DELETE to discover create/update/delete actions.

Instead of this:
POST /api/chat/join/123 \[…] Content-type: application/xml → test

Try this:
POST /api/chat/join/123 \[…] Content-type: application/json {"user": "test"}

Tip: Access controls may be inconsistently implemented across different content types. Don’t forget to try alternative and less common values like text/xml, text/x-json, and similar.

Example:
GET /user_data/2341 --> 401 Unauthorized
GET /user_data/2341.json --> 200 OK
Tip: Experiment by appending different file extensions (e.g. .json, .xml, .config) to the end of requests that reference a document.

There may be multiple ways of referencing objects in the database and the application only has access controls on one.
Try numeric IDs anywhere non-numeric IDs are accepted:
Example:
username=user1 → username=1234
account_id=7541A92F-0101-4D1E-BBB0-EB5032FE1686 → account_id=5678
album_id=MyPictures → album_id=12

If a regular ID replacement isn’t working, try wrapping the ID in an array and see if that does the trick. For example:
{“id”:19} → {“id”:[19]}

These can be very exciting bugs to find in the wild and are so simple. Try replacing an ID with a wildcard. You might get lucky!
GET /api/users/<user_id>/ → GET /api/users/*

If you stumble upon a newly added feature within the web app, such as the ability to upload a profile picture for an upcoming charity event, and it performs an API call to:
/api/CharityEventFeb2021/user/pp/<ID>
It is possible that the application may not enforce access control for this new feature as strictly as it does for core features.