api-authorization-and-bola
yaklang/hack-skills
Test API authorization, BOLA, BFLA, and mass assignment vulnerabilities across object and function access.
What is api-authorization-and-bola?
A focused authorization testing playbook for APIs that expose object identifiers, nested resources, or role-sensitive functions. Use this skill to systematically test for broken object-level access control (BOLA), broken function-level access control (BFLA), HTTP method abuse, and hidden field mass assignment.
- Test object-level authorization by replaying requests across different user accounts
- Probe nested resources and sibling endpoints for authorization gaps
- Attempt HTTP method variations (PUT, PATCH, DELETE) on the same routes
- Inject privilege-escalation payloads into JSON fields (role, isAdmin, org, verified, tier)
- Discover hidden writable fields in API responses and admin documentation
How to install api-authorization-and-bola
npx skills add https://github.com/yaklang/hack-skills --skill api-authorization-and-bolaHow to use api-authorization-and-bola
- 1.Create two test accounts (Account A and Account B) with different roles or permissions
- 2.As Account A, capture HTTP requests for create, read, update, and delete operations
- 3.Replay each request using Account B's authentication token and observe whether access is granted or denied
- 4.Test sibling endpoints and nested resources (e.g., /api/v1/users/1/invoices/9) with Account B's token
- 5.Attempt HTTP method variations (PUT, PATCH, DELETE) on endpoints tested with GET
- 6.Inject privilege-escalation payloads (role, isAdmin, org, verified, tier) into request bodies and observe server response
- 7.Check API documentation and admin endpoints for hidden writable fields not visible in normal responses
Use cases
- Verify that Account B cannot read or modify Account A's orders, invoices, or personal data via object ID manipulation
- Test whether alternate HTTP verbs bypass authorization checks on the same endpoint
- Attempt to escalate privileges by injecting admin or elevated role fields into create/update requests
- Identify nested resource authorization gaps (e.g., /api/v1/users/1/invoices/9 accessible by unauthorized users)
- Discover and exploit hidden writable fields revealed in API documentation or responses
- API security testers
- Penetration testers focusing on authorization flaws
- Security researchers auditing multi-tenant or role-based APIs
- Developers validating authorization controls during API design
api-authorization-and-bola FAQ
BOLA (Broken Object-Level Access Control) occurs when an API fails to check if a user owns or has permission to access a specific object (e.g., order 123). BFLA (Broken Function-Level Access Control) occurs when an API fails to restrict access to administrative or sensitive functions (e.g., /api/v1/admin/users). Both are authorization flaws but target different API surfaces.
Object IDs appear in URL paths (/api/orders/123), query parameters (?id=123), request bodies, response bodies, headers, cookies, GraphQL arguments, and nested object references. Check all locations systematically.
UUIDs and opaque tokens do not prevent BOLA; they only make ID enumeration harder. Focus on authorization logic: if you can obtain a valid ID (from your own account, error messages, or documentation), test whether the API checks ownership before granting access.
Capture a successful create or update request, then inject additional JSON fields (role, isAdmin, org, verified, tier) into the request body. If the server accepts and stores these fields without error, the API may allow mass assignment or privilege escalation.
Document the affected endpoint, the HTTP method, the object ID or function name, the authorization bypass technique, and the impact (read, write, delete, or privilege escalation). Report to the API owner with a proof-of-concept request and remediation guidance.
Full instructions (SKILL.md)
Source of truth, from yaklang/hack-skills.
name: api-authorization-and-bola description: >- API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
SKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment
AI LOAD INSTRUCTION: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.
1. CORE TEST LOOP
- Create Account A and Account B.
- As Account A, capture create, read, update, and delete flows.
- Replay with Account B's token.
- Test sibling endpoints, nested endpoints, and alternate HTTP verbs.
2. TEST SURFACES
| Surface | Example |
|---|---|
| object read | /api/v1/orders/123 |
| nested object | /api/v1/users/1/invoices/9 |
| admin or internal function | /api/v1/admin/users |
| update path | PUT, PATCH, DELETE variants |
| hidden JSON fields | role, org, verified, tier |
3. QUICK PAYLOADS
{"role":"admin"}
{"isAdmin":true}
{"org":"target-company"}
{"verified":true}
4. WHAT TESTERS MISS
- object IDs in headers, cookies, GraphQL args, and nested objects
- alternate methods sharing the same route but weaker authz
- parent check present, child resource check missing
- admin docs revealing extra writable fields
5. NEXT ROUTING
- For JWT or token-layer abuse: api auth and jwt abuse
- For GraphQL and hidden parameter discovery: graphql and hidden parameters
- For broader IDOR patterns outside APIs: idor broken object authorization
Related skills
More from yaklang/hack-skills and the wider catalog.
api-recon-and-docs
Discover API endpoints, schemas, versions, and hidden documentation surface before testing.
api-sec
Entry point router for API security testing—choose between recon, authorization, token abuse, and GraphQL workflows.
arbitrary-write-to-rce
Convert arbitrary write primitives into code execution by targeting GOT, hooks, _IO_FILE, exit_funcs, TLS_dtor_list, and other glibc structures.
auth-sec
Entry point router for authentication, authorization, sessions, and identity protocol testing.
authbypass-authentication-flaws
Authentication bypass testing playbook for login flows, password reset, MFA, and token flaws.
binary-protection-bypass
Identify and bypass ASLR, PIE, NX, canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries.