bola-idor

Test API endpoints for BOLA and IDOR vulnerabilities through differential response analysis.

Updated Feb 23, 2026

Search Tags:#authorization #access control #penetration testing #api security #idor #bola

Ready to run

npx skills add https://github.com/devtint/API_PENTEST --skill bola-idor-devtint

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: bola-idor
Source: https://github.com/devtint/API_PENTEST/tree/main/testing/SKILLS/bola-idor
Command: npx skills add https://github.com/devtint/API_PENTEST --skill bola-idor-devtint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill protects against unauthorized access to sensitive data by identifying and testing for vulnerabilities where users can access resources belonging to others.

Core Features & Use Cases

BOLA/IDOR Testing: Systematically tests for Broken Object Level Authorization and Insecure Direct Object Reference flaws.
Resource Access Control Validation: Verifies that users can only access data they are explicitly permitted to see.
Use Case: An attacker uses their user token to try and access another user's order details or profile information via API calls. This skill automates the process of detecting such unauthorized access.

Quick Start

Use the bola-idor skill to test the /api/users/{id} endpoint for unauthorized access using attacker ID 456 and victim ID 123.

Frequently Asked Questions about bola-idor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is broken object level authorization testing for APIs?▼

Broken object level authorization testing verifies that API endpoints properly restrict users from accessing resources outside their ownership. It identifies IDOR vulnerabilities by manipulating object identifiers in requests to detect unauthorized data exposure across distinct user accounts.

How do I test for IDOR vulnerabilities in API endpoints?▼

To test for IDOR vulnerabilities, systematically identify object identifiers in API requests and attempt to access resources belonging to other users. This process requires distinct user accounts to perform differential analysis of API responses.

Can I validate API access controls without multiple user accounts?▼

Validating API access controls requires distinct user accounts for effective testing. You need an attacker account and a victim account to compare differential responses when attempting unauthorized access to restricted administrative endpoints or user data.

What is the best way to automate BOLA detection in REST APIs?▼

The best way to automate BOLA detection is by systematically mapping object identifiers in API requests and substituting victim identifiers into attacker-authenticated calls. Differential analysis of responses confirms whether unauthorized resource access is permitted.

Does BOLA testing require specific dependencies or environments?▼

BOLA testing requires no external dependencies but needs a target API environment with distinct user accounts configured. You must supply specific object identifiers, such as an attacker ID and victim ID, to execute differential authorization checks.