A real world IDOR which is harder to find:
- Login into the web application
- Watch the corresponding users’ ID
- Find a way to disclose other users ID
- You may need to play with the API a little bit
- Objective: find the admin’s user information

Safe UUID

This challenge simulates a **real-world IDOR** vulnerability that’s harder to spot. The goal is to exploit an issue with how user IDs are managed in the system.  

### Steps  
1. **Login** into the web application and observe the user’s unique ID.  
2. **Find a way** to disclose other users' IDs. You may need to inspect API calls or analyze the requests in the background.  
3. Use your findings to **access the admin’s attachment (ID: 23)**.  

### Requirements  
- **Knowledge of API Interactions**: You may need to interact with the API to discover hidden endpoints or data.  
- **Exploration of the Application**: Observe how the system handles user IDs and determine if they can be manipulated.  
- **Insecure Direct Object Reference (IDOR)

### Objective  
Your goal is to find a way to **access the admin's attachment** by exploiting an **IDOR vulnerability** in the web application.  


Hack the Object

گواهینامه شرکت در کلاس هانت به مدت ۶ ماه، در این مدت مباحث و متدولوژی هانت به بچه‌ها آموزش داده شد، این گواهینامه فاقد امتحان است.