bola-idor
Guides investigation of object-level authorization flaws and insecure direct object references. Covers user-scoped resources, horizontal privilege escalation, altered identifiers, blind and second-order IDOR, encoded references, and deprecated API versions.