I feel like there are probably a lot of easy targets available. Look at the network requests between the client and server and see if there is anything that loo

I feel like there are probably a lot of easy targets available. Look at the network requests between the client and server and see if there is anything that looks like its not validated. If you see ids try changing them and see what happens. Quite often it seems that the back end just trusts whatever the client sends. Especially if its a mobile app or a SPA because new devs seem to think the api is only visible to them. From reading some of these hacks on peoples blogs it seems like quite often they just man in the middle a mobile app and find out the api provides way more info than should be shown to the user and the ui hides it.