detecting-api-enumeration-attacks

Detect API enumeration and BOLA attempts by analyzing access patterns and authorization failures.

2|Updated Apr 14, 2026

Search Tags:#logs #detection #siem #idor #bola #api-enumeration

Ready to run

npx skills add https://github.com/Acczdy/MoZiSec --skill detecting-api-enumeration-attacks

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: detecting-api-enumeration-attacks
Source: https://github.com/Acczdy/MoZiSec/tree/main/api-security/.claude/skills/detecting-api-enumeration-attacks
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill detecting-api-enumeration-attacks

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Detect API enumeration attacks (including BOLA) by monitoring access patterns, authorization failures, and abnormal API usage to prevent data exposure.

Core Features & Use Cases

Detection of Sequential ID Enumeration, UUID/GUID enumeration, and Parameter Tampering enumeration across API endpoints.
Prebuilt detection rules and scripts for Splunk, Elastic SIEM, and custom Python detection.
Prevention guidance including strict authorization checks and rate-limiting recommendations.

Quick Start

Run the detection agent against your API logs to identify enumeration patterns in real time.

Frequently Asked Questions about detecting-api-enumeration-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect API enumeration attacks in my SIEM logs?▼

Detect API enumeration attacks by running the included Splunk or Elastic SIEM queries against your access logs to identify sequential ID enumeration, UUID enumeration, and parameter tampering patterns. The prebuilt rules analyze authorization failures and abnormal API usage to prevent data exposure.

What is BOLA and how does API enumeration detection identify it?▼

BOLA (Broken Object Level Authorization) is an API vulnerability where users access unauthorized data by enumerating object IDs. Detection identifies BOLA attempts by monitoring access patterns and authorization failures across API endpoints, flagging sequential or UUID enumeration and parameter tampering.

Can I use this to detect BOLA attacks without Splunk or Elastic SIEM?▼

Yes, you can detect BOLA attacks without Splunk or Elastic SIEM by using the included Python-based detector script. The script requires the requests library and analyzes your API logs to identify enumeration patterns and authorization failures in real time.

What is the best way to monitor API authorization failures for data exposure?▼

The best way to monitor API authorization failures is applying configurable detection rules with severity scoring and time windows to your API gateway or back-end service logs. This approach catches abnormal API usage and prevents data exposure from enumeration attacks.

Do I need API gateway logs to detect sequential ID enumeration?▼

You need API gateway, SIEM, or back-end service logs to detect sequential ID enumeration. The detection agent analyzes these access logs to identify abnormal API usage patterns and applies guardrails to ensure accurate severity scoring.