bfla

Turn a browser Copy-as-cURL of a login/signup into a ready-to-use multi-account auth test spec for BOLA/IDOR and BFLA (A owns the data, B attacks, optional admin for function-level authz). Manual mode runs 100% in your browser.

Scanner differentiel BOLA/BFLA pour APIs REST & GraphQL — audit les controles d autorisation en comparant les reponses entre roles (VAmPI, DVGA, crAPI).

Authorization regression testing for REST APIs and MCP servers in CI/CD. Define access policies as a matrix, generate positive and negative tests, and detect BOLA, BFLA, BOPLA and privilege escalation — with drift baselines, confidence grading and CWE/OWASP-tagged SARIF reports.

Proof of concept for exploitation of the vulnerability described in CVE-2025-11554, which concerns the possibility of a privilege escalation through arbitrary requests to user types change endpoint in the i-Educar software.

Repository-first API authorization pentest skill: runtime-confirmed OWASP API Top 10 (BOLA/BFLA/IDOR) testing with a built-in safety harness. AI-agent / Claude Skill ready.

Black-box REST API security tester that finds broken-authorization bugs (BOLA/BFLA) with zero false positives — no source, no AI required.

Reconstructs a single-page app's hidden API surface from its stripped JS bundle, diffs it across identities to isolate the role-gated routes a low-privilege session never sees, and deterministically proves broken access control (BOLA/IDOR) using the app's own sibling endpoints as the ownership oracle.

Config-driven REST API authorization security scanner for detecting BOLA, BFLA, mass assignment, excessive data exposure, and privilege escalation.

Authorization security scanner for BOLA, IDOR, BFLA, relationship access control, and safe retesting.

Authorization / BOLA differential tester — replay captured requests across identities (owner/peer/lowpriv/unauth) and flag IDOR/BOLA, missing-auth, and privilege escalation. Zero-dependency Python, scope-gated, reads-only by default.

Deterministic black-box authorization testing for web APIs. Finds IDOR/BOLA, BFLA and mass assignment, and confirms every finding with a multi-principal state read-back instead of guessing from status codes.

Professional simulated web application penetration testing lab demonstrating evidence-driven assessment, vulnerability validation, remediation, and retesting.

Scanner automatizado de vulnerabilidades em APIs REST, com detecção determinística baseada no OWASP API Security Top 10 (2023). TCC em Sistemas de Informação — UFV.

I made an easy docker build shell script for this. Intentionally vul API for hacking.