webPromedium
Lab 22 — GrubFleet — IDOR in GraphQL Store Management API
hackadvisor
Task: Food delivery platform with merchant portal and GraphQL API. Solution: Exploited IDOR in storeDetails query to access other stores' internalConfig containing API key (flag).
$ ls tags/ techniques/
idor_exploitationapi_enumerationgraphql_introspectionauthorization_bypass
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 31 — PayStream — IDOR in GraphQL Billing API— hackadvisor
- [web][Pro]Lab 116 — InsightForge — IDOR via Undocumented Internal API— hackadvisor
- [web][Pro]Lab 251 — PulseBoard — IDOR via Unauthenticated GraphQL User Profile Query— hackadvisor
- [web][Pro]Lab 15 — ProfileHub — IDOR in User Profile API— hackadvisor
- [web][Pro]Lab 23 — KeyVault Pro — IDOR in 2FA Device Removal— hackadvisor