web2-vuln-classes

# WEB2 BUG CLASSES — 26 Classes Root cause, pattern, bypass table, chaining opportunity, real paid examples. > **Auth-required classes** (🔐): the ones below need **at least one logged-in > session** loaded into the hunt to be testable. Use `hunt.py --auth-file > .private/T.json` or `--cookie/--bearer` flags — every recon/scan tool then > inherits the headers automatically. For IDOR/BOLA/priv-esc, load **two > sessions** (low- and high-priv) and diff. See `docs/auth-sessions.md`. > > 🔐 IDOR · Broken Auth/Access Control · Mass Assignment · OAuth/OIDC · JWT · > GraphQL field-level auth · LLM/AI chatbot IDOR · MFA (rate-limit + response > manipulation tests) · ATO chains · SSRF behind login > > The MFA workflow-skip and SAML signature-stripping probes intentionally > stay **unauthenticated** even when a session is loaded — that's the > attack premise. --- ## 1. IDOR — INSECURE DIRECT OBJECT REFERENCE 🔐 > #1 most paid web2 class — 30% of all submissions that get paid. > **Needs two sessions** (A=attacker, B=victim) — load both via `--auth-file` > and diff audit-log `session_id` hashes to confirm cross-tenant access. ### Root Cause ```python # VULNERABLE — no ownership check @app.route('/api/orders/<order_id>') def get_order(order_id): order = db.query("SELECT * FROM orders WHERE id = ?", order_id) return jsonify(order) # Never checks if order belongs to current user! # SECURE @app.route('/api/orders/<order_id>') def get_order(order_id): order = db.query("SEL...