skills.rest
yaklang
yaklangOFFICIAL
Explore all skills by this author →
GitHub

api-authorization-and-bola

Detect unauthorized object and function access in REST and GraphQL APIs.

1.6k|204|Updated Apr 7, 2026
Search Tags:#authorization#api#jwt#graphql#idor#mass-assignment#bola
One-click install
npx skills add https://github.com/yaklang/hack-skills --skill api-authorization-and-bola
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-authorization-and-bola
Source: https://github.com/yaklang/hack-skills/tree/main/skills/api-authorization-and-bola
Command: npx skills add https://github.com/yaklang/hack-skills --skill api-authorization-and-bola

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

APIs often expose object identifiers, nested resources, or hidden writable fields that allow unauthorized users to read, modify, or perform privileged functions on other users' data; this skill provides a focused playbook to systematically find those authorization weaknesses (BOLA/IDOR, function-level flaws, and mass assignment).

Core Features & Use Cases

  • Core test loop: Create Account A and Account B, capture create/read/update/delete flows as Account A, then replay those flows with Account B's token to confirm access control failures.
  • Surface coverage: Tests object read paths, nested resources, alternate HTTP verbs, admin/internal endpoints, and hidden JSON fields such as role, org, verified, and tier.
  • Payloads & heuristics: Provides quick JSON payloads for mass-assignment checks and lists common tester oversights like IDs in headers, cookies, GraphQL args, and sibling endpoints.
  • Use Case: Use during bug bounty or pentest engagements to validate object-level authorization and function-level access controls across REST and GraphQL APIs.

Quick Start

Use the api-authorization-and-bola skill to test an API by creating two users, exercising full CRUD flows with one user, and replaying those requests with the second user's token to identify unauthorized object or function access.

Frequently Asked Questions about api-authorization-and-bola

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for BOLA and IDOR vulnerabilities in REST and GraphQL APIs?▼

To test for BOLA and IDOR vulnerabilities, create two user accounts, capture CRUD operations as one user, and replay those requests using the second user's authentication token to identify unauthorized object or function access.

How does account-to-account replay detect broken API object authorization?▼

Account-to-account replay detects broken API object authorization by capturing create, read, update, and delete flows from one account, then replaying them with another account's token to confirm if unauthorized access control failures exist.

Can I test for mass assignment and hidden JSON fields in APIs during a pentest?▼

Yes, you can test for mass assignment and hidden JSON fields by applying quick JSON payloads during CRUD flows to check for hidden writable fields like role, org, verified, and tier in REST and GraphQL APIs.

What is the best way to find function-level authorization gaps in APIs?▼

The best way to find function-level authorization gaps is by testing alternate HTTP verbs, admin endpoints, and internal paths while exercising CRUD flows to detect unauthorized privileged function access in APIs.

Why do API authorization tests miss IDOR vulnerabilities in headers and cookies?▼

API authorization tests miss IDOR vulnerabilities when testers overlook object identifiers located in headers, cookies, GraphQL arguments, and sibling endpoints instead of standard request body parameters.

Related Skills

Explore More Software Engineering Skills→
JaiminVadadoriyaJaiminVadadoriya
1

api-testing

Automate REST and GraphQL API tests with schema validation and authentication.

Community
Advanced
YlikenYliken
5

api-authorization-and-bola

Detects and tests API authorization gaps in object access and function controls.

Community
Advanced
naporin0624naporin0624
3

form-security-analyzer

Analyzes HTML forms for CSRF tokens, insecure actions, missing validation, hidden field exposure and misconfigurations, generating text or JSON reports.

Community
Intermediate
sayseven7sayseven7
11

api-authorization-and-bola

Detect broken API authorization controls on REST and GraphQL endpoints.

Community
Intermediate