Sometime applications are so dumb that they trust our parameters
cookie or biscuit
Let me chat as Headmaster.
Sometime we list something in directories creating directory listing
IDOR will always be simple and lethal