ROT HACKERSACADEMYStart learning
Courses/Authorization by Design/Lesson 01
02.01 / 55 min

Prove horizontal IDOR / BOLA

Run a four-identity access matrix against secure and insecure object routes and save the true positive.

By the endSet attacker and owner aliasesRead matrix behaviorConfirm with more than one object
Controlled exercise

Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.

01

Establish the secure baseline

In HTTP Forge select User A as attacker, User B as owner, choose Horizontal IDOR/BOLA, and run AuthZ Matrix on the secure route.

GET http://127.0.0.1:5177/api/resources/resource-b
Expected result

Anonymous 401, User A 403, User B 200, Admin 200. This is expected access control, not a vulnerability.

02

Test the vulnerable pair

Change only resources to resources-insecure. Keep object, identities, and policy unchanged, then run the matrix again.

GET http://127.0.0.1:5177/api/resources-insecure/resource-b
Expected result

User A and User B both receive owner data with 200. WSHawk should classify matched foreign access as suspicious.

03

Confirm a second foreign object

Reverse attacker and owner, change resource-b to resource-a, and run the same policy. Require two confirmed foreign objects before increasing confidence.

Expected result

User B can read User A’s object on the insecure route.

04

Save the finding

Create a finding with endpoint, attacker and owner aliases, status codes, sanitized bodies, response hashes, object IDs, policy, timestamp, and replay steps.

MASTERY CHECKPOINT

Prove it before moving on.

Your finding includes two foreign resources and clearly separates the secure control from the vulnerable behavior.