𓆩⚜𓆪 Broken Object Level Authorization (BOLA) es una de las vulnerabilidades más críticas y frecuentes en aplicaciones web y APIs 𓆩⚜𓆪. Consiste en que la aplicación no verifica correctamente si un usuario tiene permisos para acceder, modificar o eliminar un objeto específico (como cuentas, pedidos, documentos o perfiles), permitiendo que un atacante manipule identificadores para acceder a recursos de otros usuarios. Detectarla implica comprender la lógica de autorización, analizar cómo se referencian los objetos y comprobar si el servidor valida adecuadamente la propiedad y los permisos sobre cada recurso solicitado.
✦ Es la colección de informes más completa que pude lograr, buscando en diferentes rincones de Internet.
✦ Tip: en caso de que FreeMedium esté caído, casi siempre aparece algún mirror o alternativa similar.
✦ Las técnicas y patrones generales de cada informe me los reservo, al menos hasta el momento de publicar mi tool web, anteriormente llamada Excalibur y hoy en
día llamada ❦ Lanza del Cielo Invertida ❦ .
𓆩⚜𓆪 Saludos 𓆩⚜𓆪
✦ En esta sección encontrarás 51 informes reales sobre recon general de bug bounty que leí, estudié y guardé en mi gestor de informes para bug bounty personal.
https://freedium-mirror.cfd/https://medium.com/p/d93f54a6a9b0
https://freedium-mirror.cfd/https://medium.com/@gowthami09027/api-pentesting-part-4-broken-object-level-authorization-the-silent-identity-swap-b6f38a4f8d10
https://blog.robotti.io/the-danger-of-vibe-coding-how-a-broken-object-level-authorization-bola-bug-slipped-into-an-ai-c8173a0e8536
https://adeolaodunlade.medium.com/understanding-broken-object-level-authorization-bola-what-it-is-how-it-happens-and-how-to-66d96b22b999
https://medium.com/@kkrutika04/broken-object-level-authorization-bola-vulnerabilities-in-crapi-87da0ff73d44
https://freedium-mirror.cfd/https://medium.com/@jameswizz/broken-object-level-authorization-203b5b8d2db6
https://freedium-mirror.cfd/https://hafiqiqmal93.medium.com/the-backend-engineers-guide-to-broken-object-level-authorization-5b77bdbb00e0
https://infosecwriteups.com/what-is-bola-3-digit-bounty-from-topcoder-a25e7fae0d64
https://infosecwriteups.com/broken-object-level-authorization-vs-broken-functionality-level-authorization-api-hacking-aa360dcb0986
https://infosecwriteups.com/api-pentesting-broken-object-level-authorization-bola-2227be0069dc
https://freedium-mirror.cfd/https://medium.com/lets-code-future/broken-object-level-authorization-bola-the-api-flaw-you-cant-ignore-cc2a9d4e1b06
https://medium.com/@bubu.tripathy/broken-object-level-authorization-bola-the-silent-threat-in-api-security-2fe5f57b21b2
https://master-spring-ter.medium.com/owasp-api-security-top-1-broken-object-level-authorization-and-solutions-in-spring-boot-8f3742d4111b
https://blackhawkk.medium.com/hunting-broken-object-level-authorization-9b499fc0f327
https://medium.com/@suyogpatil1810/broken-object-level-authorization-bola-in-apis-leads-to-information-discloser-11ac03010d7a
https://medium.com/@vssec/crapi-broken-object-level-authorization-bola-fbe2670a9490
https://hasharmujahid.medium.com/broken-object-level-authorization-api-security-0x1-a1a2638fc8c9
https://muh-hidayat7799.medium.com/owasp-api-security-offensive-prespective-broken-object-level-authorization-1-21dbdcfddae0
https://freedium-mirror.cfd/https://gupta-bless.medium.com/api-security-broken-object-level-authorization-9010a5217558
https://medium.com/@narendarlb123/broken-object-level-authorization-bola-complete-guide-part-3-14128a447743
https://freedium-mirror.cfd/https://medium.com/@tihomir.manushev/fixing-owasp-api1-2023-broken-object-level-authorization-in-symfony-7-3bdc8247e8ad
https://freedium-mirror.cfd/https://thexssrat.medium.com/understanding-and-testing-for-api1-2023-broken-object-level-authorization-d46a533bab93
https://sourabhpradhan-pentest.medium.com/api-broken-object-level-authorization-bola-9369a6ceb5bb
https://itnext.io/web-api-security-champion-broken-object-level-authorization-owasp-top-10-bc1d369592e2
https://medium.com/@riteshs4hu/api-owas-top-10-part-1-broken-object-level-authorization-668e9a99746d
https://freedium-mirror.cfd/https://medium.com/@sweshinfosec/identifying-and-mitigating-broken-object-level-authorization-bola-vulnerabilities-in-apis-bc137c03ce3a
https://medium.com/traceable-and-true/owasp-api1-2019-what-is-broken-object-level-authorization-and-why-its-important-ab0c7efa86fe
https://medium.com/@stux/from-broken-object-level-authorization-to-the-massive-financial-attack-93e70f26e30c
https://freedium-mirror.cfd/https://medium.com/2023-owasp-top-10/broken-object-level-authorization-ola-30784ff0605f
https://im4x.medium.com/discovered-30-bola-idor-vulnerabilities-in-a-single-subdomain-bbp-a382e4554e71
https://freedium-mirror.cfd/https://meetcyber.net/bola-idor-critical-api-authorization-flaw-bug-bounty-detection-3203133a5040
https://medium.com/@narendarlb123/broken-object-level-authorization-bola-complete-guide-part-6-d7ff06747919
https://medium.com/@narendarlb123/broken-object-level-authorization-bola-complete-guide-part-14-82007437261b
https://www.updatelap.com/2018/07/the-malicious-person-add-people-to-top.html
https://arbazhussain.medium.com/idor-while-connecting-social-account-in-hackster-io-2296b316b7a7
https://medium.com/@cjlegacion24/how-i-was-able-to-view-private-tweets-of-any-private-twitter-account-86a9d2640ded
https://infosecwriteups.com/abusing-new-claps-feature-in-medium-6bd8757a64a4
https://medium.com/@JubaBaghdad/how-i-was-able-to-delete-any-image-in-facebook-community-question-forum-a03ea516e327
https://medium.com/@saamux/spoof-a-user-to-create-a-description-of-a-group-in-flickr-72b6b8432404
https://medium.com/@aayushpokhrel/how-i-hacked-admin-account-via-password-reset-idor-of-one-private-currency-exchanger-site-51723c7c8704
https://1337n0x.medium.com/idor-how-i-was-able-to-see-any-private-album-passwrod-in-picturepush-264913f45e10
https://medium.com/@cachemoney/using-a-github-app-to-escalate-to-an-organization-owner-for-a-10-000-bounty-4ec307168631
https://medium.com/@black_b/yahoo-idor-elimination-of-any-comment-e898f4f955f1
https://blog.securitybreached.org/2018/09/16/idor-account-takeover-using-facebook/
https://infosecwriteups.com/add-description-to-instagram-posts-on-behalf-of-other-users-6500-7d55b4a24c5a
https://infosecwriteups.com/idor-in-jwt-and-the-shortest-token-you-will-ever-see-uid-1234567890-4e02377ea03a
https://infosecwriteups.com/how-i-was-able-to-generate-access-tokens-for-any-facebook-user-6b84392d0342
https://saadahmedx.medium.com/idor-account-takeover-1ff5a2d03b8b
https://philippeharewood.com/removing-profile-pictures-for-any-facebook-user/
http://z0h3.medium.com/how-to-test-for-idor-the-practical-methodology-fec3688febfb
https://freedium-mirror.cfd/https://systemweakness.com/idor-mastery-from-basic-id-changes-to-advanced-techniques-that-pay-10k-bounties-1f106016e039
"Dejo una plataforma con dork ya aplicado para encontrar aún más informes sobre IDOR. Muy interesante."
https://pentester.land/writeups/?s=Broken%20Object%20Level%20Authorization%20(BOLA)
url videos:
https://www.youtube.com/watch?v=_ISp2WGwqHI
https://www.youtube.com/watch?v=Yr8qhYlIzXA
"Dejo también una lista de informes sobre la comprensión de los identificadores únicos: UID, UUID, GUID, CUID y Nano ID."
https://osamadev.medium.com/understanding-unique-identifiers-uid-uuid-guid-cuid-and-nano-id-3ef2d104ecdf
https://medium.com/@omarzzu/from-javascript-analysis-to-uuid-pattern-exploration-revealed-a-critical-idor-5c526451e7ec
https://infosecwriteups.com/uuids-a-false-sense-of-security-10467497daae
https://medium.com/pentesternepal/tackling-idor-on-uuid-based-objects-71e8cb2dc265
https://medium.com/@dimpchubb/exploiting-uuids-in-account-takeover-a-penetration-testers-guide-to-bypassing-insecure-token-96de9cc520a3
https://medium.com/@iski/how-i-cracked-the-uncrackable-uuids-and-found-every-users-secret-data-f0cd2224e09d
https://medium.com/@RakanAllhyani/uuid-injection-0-click-superadmin-ato-3dc46a19c9ad
https://medium.com/@tinopreter/500-for-a-uuid-swap-i-almost-gave-up-on-this-idor-ae7a0adb518d
