/api-authorization-and-bola
API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
$ npx -y skills add yaklang/hack-skills --skill api-authorization-and-bola --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/api-authorization-and-bola
Context preview
The summary Claude sees to decide when to auto-load this skill.
API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
SKILL.md
api-authorization-and-bola.SKILL.mdname: api-authorization-and-bola
description: >-
API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
SKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment
> **AI LOAD INSTRUCTION**: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.
1. CORE TEST LOOP
1. Create Account A and Account B. 2. As Account A, capture create, read, update, and delete flows. 3. Replay with Account B's token. 4. Test sibling endpoints, nested endpoints, and alternate HTTP verbs.
2. TEST SURFACES
| Surface | Example | |---|---| | object read | `/api/v1/orders/123` | | nested object | `/api/v1/users/1/invoices/9` | | admin or internal function | `/api/v1/admin/users` | | update path | `PUT`, `PATCH`, `DELETE` variants | | hidden JSON fields | `role`, `org`, `verified`, `tier` |
3. QUICK PAYLOADS
{"role":"admin"}
{"isAdmin":true}
{"org":"target-company"}
{"verified":true}4. WHAT TESTERS MISS
- object IDs in headers, cookies, GraphQL args, and nested objects
- alternate methods sharing the same route but weaker authz
- parent check present, child resource check missing
- admin docs revealing extra writable fields
5. NEXT ROUTING
- For JWT or token-layer abuse: [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md)
- For GraphQL and hidden parameter discovery: [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md)
- For broader IDOR patterns outside APIs: [idor broken object authorization](../idor-broken-object-authorization/SKILL.md)
Read more
name: api-authorization-and-bola description: >- API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
SKILL: API Authorization and BOLA — Object Access, Function Access, and Mass Assignment
> **AI LOAD INSTRUCTION**: Use this skill when an API exposes object IDs, nested resources, or role-sensitive functions and you need a focused authorization test path: BOLA, BFLA, method abuse, and hidden field control.
1. CORE TEST LOOP
1. Create Account A and Account B. 2. As Account A, capture create, read, update, and delete flows. 3. Replay with Account B's token. 4. Test sibling endpoints, nested endpoints, and alternate HTTP verbs.
2. TEST SURFACES
| Surface | Example | |---|---| | object read | `/api/v1/orders/123` | | nested object | `/api/v1/users/1/invoices/9` | | admin or internal function | `/api/v1/admin/users` | | update path | `PUT`, `PATCH`, `DELETE` variants | | hidden JSON fields | `role`, `org`, `verified`, `tier` |
3. QUICK PAYLOADS
{"role":"admin"}
{"isAdmin":true}
{"org":"target-company"}
{"verified":true}4. WHAT TESTERS MISS
- object IDs in headers, cookies, GraphQL args, and nested objects
- alternate methods sharing the same route but weaker authz
- parent check present, child resource check missing
- admin docs revealing extra writable fields
5. NEXT ROUTING
- For JWT or token-layer abuse: [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md)
- For GraphQL and hidden parameter discovery: [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md)
- For broader IDOR patterns outside APIs: [idor broken object authorization](../idor-broken-object-authorization/SKILL.md)
Master Entry → Category Entries → Deep Topic Skills One master entry, six category entries, and 101 deep topic skills across 14 security domains.
Repo: yaklang/hack-skills
Other skills on hack-skills.
- /401-403-bypass-techniques
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
Open skill - /active-directory-acl-abuse
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
Open skill - /active-directory-certificate-services
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
Open skill - /active-directory-kerberos-attacks
Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.
Open skill - /ai-ml-security
AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, data privacy attacks (membership inference, model inversion), and autonomous agent security risks.
Open skill - /android-pentesting-tricks
Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.
Open skill