The five suites

Cross-user / IDOR

This suite does nothing useful until two accounts you control are stored on the target, and one is the peer of the other.

1. 01

   Add User A

   On the Identities tab, add a USER with a bearer token or a form login. Leave Peer of empty. A normal scan can also paste a bearer token for a single login crawl. The peer check still needs both accounts saved here.

2. 02

   Add User B as the peer

   Add a second USER and set Peer of to User A. The scanner sends User A’s captured URL and body with User B’s credentials.

3. 03

   Run the scan and read a match

   A finding requires the same success status and a body that is effectively the same, which means User B was allowed to see User A’s object. When a path contains an id observed during capture, the scanner can substitute that id and try the call as the other account.

GET /api/invoices/inv-9001
Identity   User B, peer of User A
Status     200
Severity   CRITICAL
Evidence   { "id": "inv-9001", "ownerId": "user-aaa-111", "card": "[REDACTED_CARD]" }

How to add the two accounts