Access Control: Enumeration of a parameter (API)¶

Identifier: bola_enum

Scanner Support¶

Description¶

API parameter enumeration occurs when changing object-identifier values in request parameters returns successful responses with distinct data for each value, revealing that the server resolves different resources without enforcing authorization. This behavior is a common precursor to broken object-level authorization, because attackers can systematically probe identifier values to discover valid objects before attempting unauthorized access.

How we test: We identify API parameters that carry object identifiers and systematically inject alternative values. When multiple distinct values return successful responses with different response bodies, we report parameter enumeration that may indicate a BOLA weakness.

Prerequisites:

• The scan must include API traffic with readable object identifiers in request parameters.

References:

• OWASP API Security Top 10: Broken Object Level Authorization
• OWASP WSTG: Testing for Insecure Direct Object References
• MITRE CWE-863: Incorrect Authorization
• MITRE CWE-639: Authorization Bypass Through User-Controlled Key

Configuration¶

Example¶

Example configuration:

---
security_tests:
  bola_enum:
    do_not_fuzz: []
    skip: false

Reference¶

do_not_fuzz¶

Type: List[string]

List of arguments to not fuzz for this security test.

skip¶

Type: boolean

Skip the test if true.