api-authorization-and-bola

Name: api-authorization-and-bola
Author: ShulkwiSEC

18stars5forks

How to install api-authorization-and-bola?

shulkwisec/bb-huge/api-authorization-and-bola

$npx -y skills add ShulkwiSEC/bb-huge --skill api-authorization-and-bola

Installs into the current project.

Summary

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment
2
3	> AI LOAD INSTRUCTION: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.
4
5	## 1. CORE TEST LOOP
6
7	1. Create Account A and Account B.
8	2. As Account A, capture create, read, update, and delete flows.
9	3. Replay with Account B's token.
10	4. Test sibling endpoints, nested endpoints, and alternate HTTP verbs.
11
12	## 2. TEST SURFACES
13
14	\| Surface \| Example \|
15	\|---\|---\|
16	\| object read \| `/api/v1/orders/123` \|
17	\| nested object \| `/api/v1/users/1/invoices/9` \|
18	\| admin or internal function \| `/api/v1/admin/users` \|
19	\| update path \| `PUT`, `PATCH`, `DELETE` variants \|
20	\| hidden JSON fields \| `role`, `org`, `verified`, `tier` \|
21
22	## 3. QUICK PAYLOADS
23
24	```json
25	{"role":"admin"}
26	{"isAdmin":true}
27	{"org":"target-company"}
28	{"verified":true}
29	```
30
31	## 4. WHAT TESTERS MISS
32
33	- object IDs in headers, cookies, GraphQL args, and nested objects
34	- alternate methods sharing the same route but weaker authz
35	- parent check present, child resource check missing
36	- admin docs revealing extra writable fields
37
38	## 5. NEXT ROUTING
39
40	- For JWT or token-layer abuse: [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md)
41	- For GraphQL and hidden parameter discovery: [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md)
42	- For broader IDOR patterns outside APIs: [idor broken object authorization](../idor-broken-object-authorization/SKILL.md)

People who liked this also viewed

6 picks

Type

api-authorization-and-bola

18stars5forks

View on GitHub

How to install api-authorization-and-bola?

shulkwisec/bb-huge/api-authorization-and-bola

$npx -y skills add ShulkwiSEC/bb-huge --skill api-authorization-and-bola

Installs into the current project.

Summary

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment
2
3	> AI LOAD INSTRUCTION: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.
4
5	## 1. CORE TEST LOOP
6
7	1. Create Account A and Account B.
8	2. As Account A, capture create, read, update, and delete flows.
9	3. Replay with Account B's token.
10	4. Test sibling endpoints, nested endpoints, and alternate HTTP verbs.
11
12	## 2. TEST SURFACES
13
14	\| Surface \| Example \|
15	\|---\|---\|
16	\| object read \| `/api/v1/orders/123` \|
17	\| nested object \| `/api/v1/users/1/invoices/9` \|
18	\| admin or internal function \| `/api/v1/admin/users` \|
19	\| update path \| `PUT`, `PATCH`, `DELETE` variants \|
20	\| hidden JSON fields \| `role`, `org`, `verified`, `tier` \|
21
22	## 3. QUICK PAYLOADS
23
24	```json
25	{"role":"admin"}
26	{"isAdmin":true}
27	{"org":"target-company"}
28	{"verified":true}
29	```
30
31	## 4. WHAT TESTERS MISS
32
33	- object IDs in headers, cookies, GraphQL args, and nested objects
34	- alternate methods sharing the same route but weaker authz
35	- parent check present, child resource check missing
36	- admin docs revealing extra writable fields
37
38	## 5. NEXT ROUTING
39
40	- For JWT or token-layer abuse: [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md)
41	- For GraphQL and hidden parameter discovery: [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md)
42	- For broader IDOR patterns outside APIs: [idor broken object authorization](../idor-broken-object-authorization/SKILL.md)

People who liked this also viewed

6 picks

Type