skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

api-authorization-and-bola

Test API object ID and hidden field authorization across roles.

241|28|Updated May 20, 2026
Search Tags:#jwt#access control#api testing#bola#mass assignment#idOR#api authorization
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill api-authorization-and-bola-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-authorization-and-bola
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/api-authorization-and-bola
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill api-authorization-and-bola-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Broken Object Level Authorization (BOLA/IDOR) and mass assignment issues let attackers access or modify other users’ data and privileged fields by manipulating object identifiers or hidden writable parameters.

Core Features & Use Cases

  • BOLA authorization testing: Exercises object ID access across object reads, nested resources, and role-sensitive/admin-like endpoints using multiple accounts.
  • Function-level and method abuse coverage: Replays actions with different tokens and checks sibling endpoints and alternate HTTP verbs for weaker authorization paths.
  • Hidden field and writable JSON control: Targets common over-posted fields such as role/org/verified/tier by supplying quick payloads and verifying enforcement.

Quick Start

Use the api-authorization-and-bola skill to test whether your API properly authorizes reads and updates to objects by identifier using two accounts and by attempting to modify hidden fields.

Frequently Asked Questions about api-authorization-and-bola

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test my API for BOLA and IDOR vulnerabilities?▼

To test for BOLA and IDOR vulnerabilities, create two test accounts, capture CRUD flows, and replay requests with different JWTs to verify if object identifiers and nested resources are improperly accessible across roles.

What is mass assignment in API security and how do I find it?▼

Mass assignment occurs when APIs accept hidden writable fields like role, org, verified, or tier in update requests. You find it by supplying payloads with these privileged fields and verifying if the API improperly accepts the modifications.

How do I check for function-level authorization flaws in my API?▼

Check for function-level authorization flaws by replaying API actions with different tokens, testing sibling endpoints, and varying HTTP verbs to identify weaker authorization paths on role-sensitive or admin-like endpoints.

Do I need multiple test accounts to perform API access control testing?▼

Yes, API access control testing requires creating two test accounts to effectively compare authorization enforcement. This dual-account setup allows you to replay requests with different tokens and validate object-level and function-level access restrictions.

Can I detect over-posting vulnerabilities by modifying JSON payloads?▼

Yes, you detect over-posting vulnerabilities by modifying JSON payloads to include privileged fields such as role, org, or tier. Submit these update requests to verify if the API enforces proper field-level restrictions or improperly accepts hidden writable fields.

Related Skills

Explore More Legal & Compliance Skills→
nicolehaugennicolehaugen

gh-auth-isolation

Manage multiple GitHub identities and switch contexts for secure operations.

Community
Advanced
YlikenYliken
5

api-authorization-and-bola

Detects and tests API authorization gaps in object access and function controls.

Community
Advanced
wheels-devwheels-dev
203

Wheels Routing Generator

Generate RESTful, nested, and custom routes for CFWheels applications.

Official
Basic
sayseven7sayseven7
11

api-authorization-and-bola

Detect broken API authorization controls on REST and GraphQL endpoints.

Community
Intermediate