$loading...
Insecure Direct Object Reference testing techniques for sequential IDs, UUIDs, encoded references, and parameter tampering. (16 payloads)
/api/users/1, /api/users/2, /api/users/3.../api/orders/1000 → /api/orders/999/api/invoice?id=100&id=101&id=102Change user_id in request body from own ID to target IDTry UUID v1 — timestamp-based, predictableSearch for UUIDs in other API responses, JS files, error messages00000000-0000-0000-0000-000000000000Change one character of known UUIDBase64 decode ID → modify → re-encodeHex decode ID → modify → re-encodeMD5/SHA hash of sequential integersJWT payload sub claim modification?user_id=123&user_id=456?user_id[]=123&user_id[]=456Change GET param and POST body to different IDsX-Original-URL: /api/admin/users/1Level up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides