Results for “bola”
10 skills
shulkwisec Bola Idor
Detect and exploit Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR) vulnerabilities in APIs and web applications.
21
mukul975 Detecting API Enumeration Attacks
Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
24.6k · bundle
mukul975 Testing API For Broken Object Level Authorization
Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR) vulnerabilities by manipulating object identifiers to detect missing per-object authorization checks.
24.6k · bundle
mukul975 Analyzing API Gateway Access Logs
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts using pandas for statistical analysis and anomaly detection.
24.6k · bundle
More results
zhaoxuya520 API Security
Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs covering discovery, authentication, authorization, rate-limiting, and CI/CD integration.
12.8k · bundle
shulkwisec API Sec
Routes API security testing into recon, authorization, token abuse, or hidden-parameter workflows based on observed endpoint characteristics.
21
shulkwisec GRAPHQL Idor
Identify and exploit Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) vulnerabilities specifically within GraphQL APIs. This skill focuses on manipulating node IDs, changing variables, and utilizing aliases to access unauthorized data.
21 · bundle
infometa Team Ops
Audit team performance using the Elon Algorithm (identify A/B/C players) and extract action items from meeting transcripts. Use when asked to "audit team performance", "review my team", "extract meeting actions", "meeting notes to tasks", "team efficiency audit", or "identify underperformers".
228 · bundle
mukul975 Performing API Security Testing With Postman
Builds repeatable API security test suites in Postman covering OWASP API Security Top 10 vulnerabilities, with automated authentication, multi-role testing, and CI/CD integration via Newman.
24.6k · bundle
shulkwisec Business Logic
Application-level business logic security testing for any domain. Takes an understanding-first approach: map the intended workflows before probing them. Covers: value/quantity logic abuse (negative, zero, overflow, rounding on any numeric field), workflow and state machine bypass (skipping required steps, forcing illegal state transitions, reusing one-time tokens), trust boundary violations (BOLA horizontal/vertical, BFLA, cross-tenant access, negative ownership attacks), idempotency and replay attacks (duplicate submissions, double-spend, same-reference reuse), multi-step flow integrity (checkout, registration, approval, verification), quota and rate limit bypass, time/date manipulation, and authorization code / reference number predictability. Domain-agnostic — applies to SaaS, e-commerce, banking, gaming, social platforms, APIs, or any multi-user application with stateful workflows. Chains from /pentester; chains into /param-fuzz when boundary violations or mass assignment are confirmed.
21