yeah URL but you can also manipulate browser async requests. Salesforce portals and plain old Salesforce make a lot of async calls back to the server which is the style these days. You watch these in your browser dev tools and sort of deduce what's happening. Then you can play around and see if you can replay these requests but pointed at different objects or records and see what happens.
It's not any different than what you can do with any other site. It's just that Salesforce is an incredibly wide and deep platform. You need to understand a lot about general web app security and then you need to know the Salesforce way of doing it across the whole platform to cover your bases. It's just a very complicated beast.
It's not any different than what you can do with any other site. It's just that Salesforce is an incredibly wide and deep platform. You need to understand a lot about general web app security and then you need to know the Salesforce way of doing it across the whole platform to cover your bases. It's just a very complicated beast.