Common API bugs
“I changed the id in the request and got somebody else’s record back.”
An endpoint authenticates the caller but never checks that the requested record belongs to them. Any authenticated session can read another tenant's object simply by knowing or guessing its id.
Object-level authorization missingorange beltAuthorization testing distinct from authentication (BOLA / IDOR)
Choose your app
The same mistake, planted in different products. Pick the domain you want to hunt it in.
TapTrust Federal
TapTrust Federal Credit Union · Banking · Online + teller
online.taptrustfederal.test
2 planted defectshunt here →
QualityMart
QualityMart Inc. · Retail · Big-box e-commerce
shop.qualitymart.test
2 planted defectshunt here →
QualityChart
St. Quality Health · Healthcare · EHR
Not seeded here yet — an open seat for a contributor to plant this defect in QualityChart.