What problem does it solve? APIs often authenticate users but fail to verify per-object authorization, letting one authenticated user read, modify, or delete another user's data by changing an object ID in the request. This Skill provides a systematic workflow to detect these Broken Object Level Authorization (BOLA/IDOR) flaws, the top risk in the OWASP API Security Top 10 2023. ## Core Features & Use Cases - Horizontal privilege escalation testing: Replay requests with one user's token against another user's object IDs across GET, PATCH, DELETE, and batch endpoints. - Object ID classification and enumeration: Identify sequential integers, UUIDs, encoded values, slugs, and composite IDs, then probe predictable ranges for unauthorized access. - Automated detection support: Configure Burp Suite Autorize for replay-based detection and run the included Python agent script to execute read/write/delete tests and produce a JSON findings report. - Use Case: During an authorized assessment of an e-commerce API, use two test accounts to discover that GET /api/v1/orders/{id} returns any customer's order and PATCH /api/v1/addresses/{id} allows modifying other users' addresses, then document findings with severity and remediation guidance. ## Quick Start Ask the agent to test the target API for BOLA by providing the base URL, two user tokens, and the victim's object IDs so it can run horizontal read and write tests and generate a findings report.
