Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prepare the request without transmitting
Set PATCH on the insecure resource, select User A, choose Horizontal IDOR/BOLA, and keep Dry-run enabled. Use one request and one object candidate.
PATCH /api/resources-insecure/resource-b
{"note":"Academy authorization proof"}The preview shows the exact request but the resource remains unchanged.
Configure evidence and cleanup
Set the before template to GET the same object. Configure cleanup as POST /api/rollback using the rollback_token returned by the PATCH. Keep the request cap below five.
Confirm and execute
Enable bounded write, acknowledge the local lab target, and choose Execute + verify + rollback. Never reuse this confirmation on a real target without written authorization and a recovery plan.
Before shows the original note, after shows the changed note, and cleanup restores the original note.
Save rollback proof
Attach sanitized before, after, and restored response hashes to the finding. Mark the test inconclusive if cleanup cannot be verified.
Prove it before moving on.
The final GET shows the original User B note and the finding contains a verified rollback result.