ROT HACKERSACADEMYStart learning
Courses/WSHawk Practitioner/Lesson 04
01.04 / 45 min

Discover object candidates

Find object identifiers in paths, queries, JSON, GraphQL variables, UUIDs, and captured traffic without unbounded guessing.

By the endDetect multiple ID locationsUse captured values firstBound mutations to the local lab
Controlled exercise

Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.

01

Find a path object

Load the resource-b request and choose Discover IDs. Confirm resource-b is marked as a path candidate. Add resource-a and the two documented UUIDs from the lab catalog.

GET /api/resources-insecure/resource-b
02

Find a query object

Load the public profile request and verify user_id is detected as a query candidate. Use only user_a and user_b as candidates.

GET /api/profile-public?user_id=user_b
03

Find JSON and GraphQL variables

Use a JSON body containing document_id, then the GraphQL lesson request containing variables.id. Confirm WSHawk identifies each location without modifying unrelated values.

{"document_id":"resource-b"}
04

Apply strict bounds

Keep the candidate list at 10 or fewer and require two foreign resources before raising confidence. Prefer captured IDs and explicit lab IDs over random enumeration.

MASTERY CHECKPOINT

Prove it before moving on.

You can show one path, one query, one JSON, one GraphQL-variable, and one UUID candidate with a documented source.