broken-object-level-authorization

Broken Object Level Authorization (BOLA/IDOR)

When to Use

• When engaging REST APIs executing actions utilizing user IDs, invoice numbers, or UUIDs in the URI path (e.g., /api/users/12 or /api/invoice/ABC-123).
• When actions refer to object primary keys inside POST/PUT bodies or query parameters.
• It is the #1 vulnerability in APIs according to the OWASP Top 10 API Security Project. Always test this relentlessly.

Prerequisites

• Authorized scope and target URLs from bug bounty program
• Burp Suite Professional (or Community) configured with browser proxy
• Familiarity with OWASP Top 10 and common web vulnerability classes
• SecLists wordlists for fuzzing and enumeration

Workflow

Phase 1: Identifying Resource Identifiers

# Concept: We must find where the API relies on an identifier to fetch, update, or delete data.

# Look closely at endpoints generating 200 OK status codes:
GET /api/v1/receipts/904                   (Path variable)
POST /api/v1/messages?conversation_id=643  (Query parameter)
{"user_id": 99, "action": "delete"}        (JSON body)

# The Threat: If I am User 99, can I read User 100's data simply by typing '100'?

Phase 2: Systematic Execution (Two-Account Testing)

# Concept: NEVER verify BOLA by testing arbitrary IDs blindly! You might delete or modify 
# actual production users. ALWAYS test between two accounts YOU control: "Attacker" and "Victim".

# 1. Setup Phase
#   Create Account A (Attacker): id = 100
#   Create Account B (Victim): id = 200
#   Post a private picture using Account B. Note the picture ID (e.g., pic_id=555).

# 2. Attack Execution
#   Log into Account A (Attacker).
#   Intercept the request fetching Account A's pictures:
    GET /api/photos/100 HTTP/1.1
    Authorization: Bearer <Attacker_Session>

# 3. Manipulation
#   Change the path ID to the Victim's ID (or the Victim's picture ID):
    GET /api/photos/200 HTTP/1.1
    # or
    DELETE /api/photo/555 HTTP/1.1

# 4. Result Validation
#   If the server responds HTTP 200 OK and returns Victim B's sensitive data, the BOLA flaw is absolutely confirmed.