api-bolalisted

# Broken Object/Function Level Authorization (BOLA/BFLA) ## When it applies An API exposes objects (BOLA) or privileged functions (BFLA) and enforces authorization weakly. The API version of IDOR — but APIs multiply the surface (many endpoints, verbs, versions, and a mobile client that trusts the server less than the web UI does). ## Why it works APIs are stateless and object-centric; each endpoint must independently check "can this token act on this object/function?". Teams centralize authentication but scatter (or forget) authorization, and hide admin functions in the client instead of the server. ## Method 1. **BOLA**: with two tokens, request another user's object id on every endpoint & verb; also try guessing/incrementing ids and IDs leaked from list endpoints. 2. **BFLA**: take an admin-only call (from JS, mobile, or docs) and replay it with a low-priv token; try method swaps (GET→PUT/DELETE) and hidden verbs the UI never issues. 3. **Version & shadow endpoints**: `/api/v1/` may lack fixes present in `/v2/`; `/internal/`, `/debug/`, Swagger/OpenAPI docs reveal ungoverned routes. 4. **Automate** with Burp **Autorize** (low-priv token as the "enforcement" session) to flag every request that succeeds when it shouldn't. ## Gotchas - 200 vs 403 is the tell, but some APIs return 200 with an empty body — diff the content. - IDs as UUIDs still leak via list/search endpoints and other objects' relations. - Rate-limit and WAF differ per API version — the vuln may