Watch Out for UUIDs in Request Parameters

This report presents UUID-Watcher, a Burp Suite extension designed to correlate UUID/GUID values across HTTP requests and responses to identify potential Insecure Direct Object Reference (IDOR) vulnerabilities and identifier leakage (e.g., orgId or schematicId). It explains the design pattern where large unique identifiers are used as access controls, shows example API flows that can expose identifiers via search endpoints leading to unauthorized access, and provides installation and usage instructions so testers can uncover such leaks in web applications.