The most reliable way to find BOLA is to compare what two different users can do to the same object. This tutorial outlines a repeatable workflow using an intercepting proxy.
Set up two sessions
Authenticate as two separate low-privilege users, User A and User B, and capture a valid credential for each. Keep both sessions available in your proxy so you can replay requests under either identity.
Map object references
Browse the application as User A and catalog every request that carries an object identifier, path parameters, query strings, and JSON bodies. These are your candidate endpoints.
Swap and observe
Take a request that legitimately returns User A’s object and re-issue it with User B’s credential (and vice versa). If User B receives User A’s data, you have found a BOLA. Automate the comparison across a range of identifiers to measure scope.
Confirm impact
Distinguish read access from write access, and record exactly which fields are exposed. A precise, minimal proof of concept is far more useful to a defender than a broad claim.
This is sample content for development and testing. Only test systems you are authorized to assess.