What problem does it solve? APIs often authenticate users but fail to verify whether the authenticated user owns the specific object being requested, allowing attackers to read or modify other users' data by swapping object IDs. This Skill provides a systematic methodology to detect Broken Object Level Authorization (BOLA/IDOR), the OWASP API Security Top 10 2023 risk API1. ## Core Features & Use Cases - Endpoint and Object ID Mapping: Enumerate API endpoints from OpenAPI/Swagger specs or Burp Suite traffic and classify object ID types (sequential integers, UUIDs, slugs, composite paths) by predictability and risk. - Horizontal Privilege Escalation Testing: Use two test accounts to systematically swap object IDs across GET, PATCH, DELETE, batch, and nested-resource requests, including parameter pollution and method-switching techniques. - Automated and GraphQL Detection: Configure the Autorize Burp extension for automated authorization replay testing and test GraphQL node/relay ID patterns for cross-user object access. - Use Case: During an authorized assessment of an e-commerce API, you discover that GET /api/v1/orders/{id} returns any customer's order and PATCH /api/v1/addresses/{id} allows modifying any user's address, then document the findings with severity, proof of concept, and remediation steps. ## Quick Start Test the target API for BOLA by capturing requests from two test accounts and swapping object IDs across all endpoints to check whether per-object authorization is enforced.
