Testing common web bugs with AI help

With a verified list of endpoints from reading the JavaScript, you can start testing for real bugs. This post covers four classes a beginner finds early: IDOR, cross-site scripting, server-side request forgery, and broken authentication. The model helps you read responses and decide the next test. You run every request and confirm every finding by hand. Keep all testing on hosts the program lists, and use a local copy of the app for anything noisy.

#How to use the model while testing

The model is a second pair of eyes on a response. Paste a request and its response and ask what the server seems to do with your input, what a safe app would return instead, and which single change would tell you more. It is fast at this and it will sometimes be confidently wrong, so each answer is a hypothesis you test, not a conclusion you report. The OWASP Web Security Testing Guide has the full procedure for each class below.

Class	The question you are asking	How you verify
IDOR	Can I reach another user's object?	Two accounts, swap the id, compare responses
XSS	Does my input run as code?	Reflected input executes in a real browser
SSRF	Will the server fetch a URL I choose?	A host you control logs the server's request
Broken auth	Can I act without the right session?	A request with no token or the wrong role succeeds

#IDOR: change the identifier, read the response

Insecure direct object reference is the friendliest bug for a beginner. Find a request with an identifier in it, such as /api/orders/1051, and change the number. If you get another user's order back, the app is not checking who owns it. The clean way to prove it is with two accounts you control: fetch your own object, then try the other account's identifier from your session, and compare. The model helps you spot which fields are identifiers and which responses differ in a way that matters.

#XSS: where input comes back as code

Cross-site scripting happens when input you send is returned to a page without being encoded, so the browser runs it as script. Your job in testing is to find a place where input reflects into the response and check whether it stays data or becomes code. A harmless marker string tells you whether, and how, your input is encoded. Cross-site scripting explained has the detail. The model is useful for reading how a value is reflected and where encoding is missing, but only a real browser proves execution, so confirm there.

#SSRF: where the server fetches a URL

Server-side request forgery happens when the app takes a URL from you and the server fetches it. Look for features that pull a remote resource: an image by URL, a webhook, a link preview. To test safely, point the feature at a host you control and watch your own logs for the server's request. If the server reaches out, you have confirmed the behavior, and the impact depends on what the server's network can reach. Describe only what you proved, and do not go hunting internal services beyond what the program allows.

#Broken authentication and access control

This class covers requests that should need a valid session or a specific role and do not. Take an authenticated request, remove the token or swap in a lower-privilege account, and see whether it still works. Access-control bugs are common, often high impact, and easy to prove with two accounts. The model can help you enumerate which actions to retry without a session, from the endpoint list you built earlier.

#Verify before you believe it

Most wasted time in a beginner's first month goes to false positives the model encouraged. Three habits prevent it. Reproduce the bug from a clean state so you know it is real and not a cached quirk. Change one variable at a time so you know what caused the result. Keep the exact request and response that prove it, because that is what the report needs and what the triager will rerun. If you cannot reproduce it on demand, it is not a finding yet.

#Next in this track

APIs deserve their own method. API testing with AI covers OpenAPI and GraphQL. The OWASP Top 10 and PortSwigger Web Security Academy are the references to work through for each class.