Most SaaS breaches are quiet authorization failures. The same /api/orders/1247 returns another customer’s data when you swap the session. That is BOLA (also called IDOR at the object layer).
Why scanners miss BOLA
Scanners are good at signatures and status codes. They rarely log in as two users, replay the same object ID under the wrong session, or diff response bodies. So a “clean” scan can still ship broken authz.
- Log in as User A and User B
- Replay the same object ID under the other session
- Diff the body, not just 200 vs 403
- Filter soft-404 pages so empty stubs are not treated as findings
Four steps to a confirmed BOLA
Identity depth
Mint or reuse User A/B on Auth0, Cognito, Firebase, or Okta so tests use real sessions.
Object replay
Sequential IDs, UUIDs, and nested resources under the wrong session inside your RoE.
Oracle checks
Control request, soft-404, and body fingerprint. The LLM plans. Rules confirm.
Mission goals
Ask Autopilot to prove BOLA on /api/users and stop when it is proved.
BOLA and IDOR
IDOR is the older name. BOLA is the OWASP API Top 10 name. Guardial covers both with the same pipeline.
Run a BOLA mission
Sign up free
₹350 wallet credit covers one Quick scan. No card needed.
Add target and RoE
URL plus written permission. Optional User A/B credentials help.
Set the goal
Prove BOLA on /api/… and stop when confirmed
Share the proof
Kill chain plus SARIF or HTML for engineering.
See pricing, API security testing, and how this differs from scanners.