API BOLA, Broken Object Level Authorization (OWASP API1)

Purpose

Test whether authenticated callers can access or modify other users' objects by manipulating object identifiers, when the server fails to enforce per-object authorization.

Preconditions

• At least two accounts with distinct data (the two-account differential is mandatory for confirmation)
• A mapped API surface (consume reconnaissance API discovery; do not re-enumerate here)
• Object IDs observed in requests (numeric, UUID, slug, encoded)

Attack Surface Signals

• Path segments with IDs: /orders/1042, /users/{id}/documents/{uuid}
• Query/body parameters: ?order_id=, {"userId": ...}, filter params
• List endpoints that leak other-context IDs (harvest victims here)
• Batch/bulk endpoints accepting arrays of IDs
• GraphQL node/relay IDs (base64 Order:5003) and user(id:) arguments

Methodology

Step 1: Harvest Object IDs

# Legitimate IDs first (own account), then victim IDs from list endpoints,
# search responses, exports, logs, comments, and any shared context.
curl -sk -H "Authorization: Bearer USER_A" "https://TARGET/api/users/me" | jq -r '.id'
curl -sk -H "Authorization: Bearer USER_A" "https://TARGET/api/users/me/orders" | jq -r '.orders[].id'