Testing for BOLA with Burp Suite: a repeatable workflow
A step-by-step workflow for finding object-level authorization flaws in APIs using an intercepting proxy and two authenticated sessions.
Tag
#api-security
Articles tagged api-security.
What is BOLA? Broken Object Level Authorization explained
A clear introduction to Broken Object Level Authorization (BOLA), why it tops the OWASP API Security list, how it happens, and how to reason about it.
An API security checklist for engineering teams
A pragmatic checklist covering authentication, authorization, input handling, and observability for teams shipping and maintaining APIs.
Building a lightweight API testing toolkit
You do not need a heavy platform to test APIs effectively. The small set of composable tools that cover most day-to-day API testing.
API reconnaissance basics: building a map before you test
Effective API testing starts with reconnaissance. How to enumerate endpoints, understand auth, and model the API before probing for flaws.