wstg-apit-02

name	wstg-apit-02
description	Testing for Broken Object Level Authorization (BOLA)
category	api-testing
owasp_id	WSTG-APIT-02
version	1.0.0
author	cyberstrike-official
tags	["api","rest","graphql","soap","wstg","apit"]
tech_stack	[]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-apit-02

Test ID

WSTG-APIT-02

Test Name

Testing for Broken Object Level Authorization (BOLA/IDOR)

High-Level Description

Broken Object Level Authorization (BOLA), also known as IDOR, occurs when an API fails to validate that the requesting user has permission to access the requested object. Attackers can manipulate object identifiers to access data belonging to other users.

---

What to Check

• User ID manipulation
• Resource ID tampering
• UUID/GUID enumeration
• Access control on all endpoints
• Horizontal privilege escalation
• Batch/bulk operations

---

How to Test

Step 1: Identify Object References

# Find endpoints with IDs
# /api/users/{id}
# /api/orders/{id}
# /api/documents/{id}

# Test with different IDs
curl -s -H "Authorization: Bearer $TOKEN" \
    "https://target.com/api/users/100" | jq '.'

curl -s -H "Authorization: Bearer $TOKEN" \
    "https://target.com/api/users/101" | jq '.'

Step 2: BOLA Testing Script

#!/usr/bin/env python3
import requests

class BOLATester:
    def __init__(self, base_url, token, own_id):
        self.base_url = base_url
        self.own_id = own_id
        self.session = requests.Session()
        self.session.headers.update({: })
        .findings = []

     ():
        
        ()

         target_id  target_ids:
             (target_id) == (.own_id):
                

            endpoint = endpoint_template.replace(, (target_id))
            url = 

            
            response = .session.get(url)
             response.status_code == :
                ()
                .findings.append({
                    : ,
                    : endpoint,
                    : 
                })

            
            response = .session.put(url, json={: })
             response.status_code  [, ]:
                ()
                .findings.append({
                    : ,
                    : endpoint,
                    : 
                })

            
            

     ():
        
        ()

         target_id  target_ids:
            response = .session.post(
                ,
                json={param_name: target_id}
            )

             response.status_code == :
                data = response.json()
                
                 (target_id)  (data):
                    ()
                    .findings.append({
                        : endpoint,
                        : param_name,
                        : 
                    })

     ():
        ( + *)
        ()
        (*)

          .findings:
            ()
            

        ()
         f  .findings:
            ()


tester = BOLATester(
    ,
    ,
    own_id=
)

tester.test_endpoint(, (, ))
tester.test_endpoint(, (, ))
tester.test_endpoint(, (, ))
tester.test_body_parameters(, , [, , ])
tester.generate_report()