Note: These demos are designed for desktop browsers. Some features may not work on mobile devices.
Demo 1 — Baseline Vulnerability

The server returns
everything.

Access control is the only gate. When it breaks, there is no second line of defence. The server returns unencrypted plaintext — SSN, card number, and balance, all exposed.

How It Works
IDOR — Insecure Direct Object Reference

You are Alice Chen (ID 1001). The API uses sequential IDs. There is no cryptographic protection — the server simply looks up the requested ID and returns whatever it stored.

Click any other user to request their record. Because access control alone gates the data, an attacker can read any record by changing the ID number.

The data is never encrypted. There is nothing standing between the attacker and the raw record.

▶Try it yourself
1You are Alice Chen (1001). Your record is shown as Authorised.
2Click Robert Hayes or any other user below. Their full record appears instantly.
3Notice SSN, card number, and balance are fully readable — no decryption needed.
4Click Reset to return to Alice. Try changing the ID number in the API bar.
GET
/api/user/
Request as:

Server Response

PLAINTEXT
User ID—
Full Name—
Email—
SSN—
Card—
Balance—
Role—

API Log

Click a user to send a request
⚠ Why This Fails

Access control is the only protection layer. When it fails, the server returns exactly what it stored. No secondary protection exists.

XenSplit adds a cryptographic layer so that even a compromised server cannot read protected fields — because the data is split across components that never meet in one place.