Find an endpoint that leaks sequential user IDs - Use the IDs with an IDOR vulnerability to access other users' data - Demonstrate mass data extraction