What problem does it solve? APIs frequently expose object identifiers, nested resources, and hidden writable fields without proper authorization checks, allowing attackers to access or modify other users' data. This Skill provides a focused, repeatable testing playbook to systematically uncover Broken Object Level Authorization (BOLA), Broken Function Level Authorization (BFLA), and mass assignment flaws. ## Core Features & Use Cases - Structured Test Loop: Guides a two-account methodology (Account A vs Account B) to replay create, read, update, and delete flows across authorization boundaries. - Test Surface Coverage: Targets object reads, nested resources, admin functions, alternate HTTP verbs, and hidden JSON fields like role, org, verified, and tier. - Quick Payloads & Routing: Supplies ready-to-use mass assignment payloads and routes to related skills for JWT abuse, GraphQL discovery, and broader IDOR patterns. - Use Case: During a web CTF or authorized penetration test, you discover an endpoint like /api/v1/orders/123. Use this Skill to replay the request with a second account's token, test PUT/PATCH/DELETE variants, and inject hidden fields such as {"role":"admin"} to escalate privileges. ## Quick Start Use the api-authorization-and-bola skill to test the target API's object endpoints for BOLA and hidden field authorization flaws using two accounts.
