Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-apit-02
Testing for Broken Object Level Authorization (BOLA)
Passed 20 of 22 test cases with the skill, and 19 of 22 without it.
2 fixed18 passed either way1 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
What official OWASP Web Security Testing Guide test identifier corresponds to 'Testing for Broken Object Level Authorization (BOLA/IDOR)'?
| Checked | Without skill | With skill |
|---|---|---|
| The response states the test ID as WSTG-APIT-02. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-APIT-02
Testing for Broken Object Level Authorization (BOLA/IDOR)
Broken Object Level Authorization (BOLA), also known as IDOR, occurs when an API fails to validate that the requesting user has permission to access the requested object. Attackers can manipulate object identifiers to access data belonging to other users.
# Find endpoints with IDs
# /api/users/{id}
# /api/orders/{id}
# /api/documents/{id}
# Test with different IDs
curl -s -H "Authorization: Bearer $TOKEN" \
"https://target.com/api/users/100" | jq '.'
test cases passed, vs 19 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.