Broken Object Level Authorization

Check List

Methodology

Black Box

IDOR

1

Create two accounts on the target (Account A = yours, Account B = second/test account)

2

Perform any action with Account A that returns or uses an object ID, Common places

Your profile → returns "id": 12345
Your orders → /api/orders/9876
Your files → /files/abc-xyz-111
Your settings → /api/v1/users/852

3

Collect every ID you see in responses (numeric, UUID, base64, hashed, username-based, etc.)

4

Switch to Account B (or log out completely) and repeat the exact same requests but replace the ID with the one from Account A

5

If you can view, modify, or delete Account A’s resource → BOLA confirmed

---

Updating Another User’s Object

1

Login as a normal user

2

Intercept profile update request

PUT /api/users/1024 HTTP/1.1
Host: target.com
Authorization: Bearer user_token_1024
Content-Type: application/json

{"phone":"9999999999"}

3

Modify object ID

PUT /api/users/1025 HTTP/1.1
Host: target.com
Authorization: Bearer user_token_1024
Content-Type: application/json

{"phone":"8888888888"}

4

Forward the request

5

If another user’s profile is updated successfully, write-level object authorization is missing

6

If no ownership validation is enforced server-side, BOLA vulnerability is confirmed.

---

Accessing Files via Object Key Manipulation

1

Login normally

2

Access file endpoint

GET /api/files/INV-2024-001.pdf HTTP/1.1
Host: target.com
Authorization: Bearer token_userA

3

Modify file identifier

GET /api/files/INV-2024-002.pdf HTTP/1.1
Host: target.com
Authorization: Bearer token_userA

4

Send request

5

If unauthorized file belonging to another account is returned, object-level access control is missing

6

If file retrieval is based solely on predictable object keys, BOLA is confirmed

---

White Bo

Cheat Sheet