Context#
“Anyone with the link” often means a long unguessable token. When the token is a short English slug or a low-entropy string, discovery is enumeration, not magic. The server must still implement a server-side rule for who may use a link, not only obscurity.
Theory#
Search engines, referrers, and public indexes may already list some “unlisted” pages. The offensive question is what happens when a second subject requests the same slug with a different session or no session.
Practice#
Walk slug space in test programs#
- In a lab, generate objects with adjacent slugs or incremental numeric public codes. Request neighbors to see if unowned slugs return
404consistently or leak metadata.
Tools#
- ffuf
- curl
- Burp Suite