bola

Burp Suite extension for API security testing with 15 attack types, 108+ payloads, intelligent fuzzing, BOLA/IDOR detection, AI integration, and automated reconnaissance. Supports REST/GraphQL/SOAP APIs with Nuclei, Turbo Intruder, and external tool integration. OWASP API Top 10 coverage.

🚀 Join us for 30days of daily API security tests. #30days30tests We've spent last 120days building amazing API security tests for the community. Next 30 days we will post test tutorials here.

API security testing framework for REST, GraphQL, and gRPC that validates authorization logic using role-based testing and YAML-driven templates

Community generated list of API security tests to find OWASP top10, HackerOne top 10 vulnerabilities

Async API security scanner in Rust for CORS, CSP, GraphQL, JWT, OpenAPI, and active API posture checks.

Burp Suite extension + port-based highlighter: dedupes HTTP history into a live unique-request feed and color-codes attacker/victim traffic by listener port (PwnFox-style) — built for Android/iOS multi-account IDOR/BOLA testing, with Magic Cookie, Match & Replace, and .http export for Claude Code / AI.

A BOLA/IDOR access-control confirmation engine — code adjudicates every verdict, not just the model, with a reproducible evidence chain.

Recon & vuln analysis from Burp Suite exports — IDORs, host injection, reset flows & payloads

AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant — no API key, right in the agent edit loop.

🛡️ Multi-tenant isolation auditor — proves whether tenant A can reach tenant B's data. Seeds two tenants, attacks one as the other, and reports confirmed BOLA/IDOR leaks with canary-backed evidence. CI merge gate, near-zero false positives. One command: docker compose up -d

Authorization contract testing for IDOR/BOLA in CI

simulator

Broken Object Level Authorization (BOLA) combined with credentialed CORS misconfiguration enables cross-user, cross-origin authenticated document exfiltration.

A lightweight, high-performance browser extension (Manifest V3) designed for penetration testers and ethical hackers. Features passive HTTP traffic inspection, automated IDOR/BOLA scoring, noise filtering, and AI-driven vulnerability analysis with PDF report generation. Built for ethical security research.

API Security Reconnaissance & BOLA Evidence Engine

AuthForge analyzes Burp traffic to learn actor to object relationships and validate BOLA/IDOR vulnerabilities using independent control objects. Dry run by default, with mutations enabled only through explicit flags.

An intentionally vulnerable Flask storefront demo for learning IDOR / broken object-level authorization.

Broken Object Level Authorization (BOLA) enables cross-user document viewing, modification, and unauthorized deletion via direct object reference.

Local-first security recon for AI coding agents: map attack surfaces, stage tailored probes, and produce a fact-grounded brief. Part of the Guard family with DocGuard and TestGuard.

Authorization testing for REST APIs and MCP servers. Declare who may do what as a matrix, and overstep turns it into positive and negative tests that catch BOLA, BFLA, BOPLA and privilege escalation — with drift baselines, confidence grading and CWE/OWASP-tagged SARIF for CI.