API Hacking Methodology: Hunting for Broken Object Level Authorization (BOLA)

Imagine you're the on-call engineer for a rapidly scaling health-tech application. You've secured the perimeter, implemented robust OAuth flows, and sanitized every database input against SQL injection. Your application feels invincible. Then, an attacker logs in as a standard user, changes the user_id parameter in a single API request from 1042 to 1043, and casually downloads another patient's entire medical history.

Welcome to Broken Object Level Authorization (BOLA)—the undisputed king of API vulnerabilities.

Formerly known as Insecure Direct Object References (IDOR), BOLA consistently ranks as the number one threat on the OWASP API Security Top 10. Despite the maturity of modern web frameworks, developers routinely fail to verify if the currently authenticated user actually holds permission to access the specific object they are requesting.

This post breaks down a practical, stage-by-stage methodology for hunting BOLA vulnerabilities during authorized testing and bug bounty engagements.

Stage 1: The Goal and Scope Rules

The goal of BOLA hunting is to prove that horizontal or vertical privilege escalation is possible by manipulating resource identifiers in API calls.

Scope Reminder: Recon, bug-bounty, and hacking content is strictly for authorized testing, learning, and defense. Never test endpoints or manipulate objects belonging to users outside of your authorized scope. The standard procedure is to provision two entirely separate test accounts (e.g., User A and User B) that you control, and attempt to access User B's data while authenticated as User A.

Stage 2: Endpoint Discovery and Traffic Mapping

Before you can manipulate parameters, you need a comprehensive map of the API's attack surface.

Start by proxying your traffic through Burp Suite or OWASP ZAP. Walk through the application normally as a standard user. Click every button, modify every setting, and upload files. The goal is to populate your proxy history with organic, authenticated API requests.

Look specifically for endpoints that manage resources via predictable identifiers (integers, sequential IDs, or easily guessable UUIDs).

Common targets include: