bfla

Authorization regression testing for REST APIs and MCP servers in CI/CD. Define access policies as a matrix, generate positive and negative tests, and detect BOLA, BFLA, BOPLA and privilege escalation — with drift baselines, confidence grading and CWE/OWASP-tagged SARIF reports.

Proof of concept for exploitation of the vulnerability described in CVE-2025-11554, which concerns the possibility of a privilege escalation through arbitrary requests to user types change endpoint in the i-Educar software.

Turn a browser Copy-as-cURL of a login/signup into a ready-to-use multi-account auth test spec for BOLA/IDOR and BFLA (A owns the data, B attacks, optional admin for function-level authz). Manual mode runs 100% in your browser.

Reconstructs a single-page app's hidden API surface from its stripped JS bundle, diffs it across identities to isolate the role-gated routes a low-privilege session never sees, and deterministically proves broken access control (BOLA/IDOR) using the app's own sibling endpoints as the ownership oracle.

Professional simulated web application penetration testing lab demonstrating evidence-driven assessment, vulnerability validation, remediation, and retesting.

Repository-first API authorization pentest skill: runtime-confirmed OWASP API Top 10 (BOLA/BFLA/IDOR) testing with a built-in safety harness. AI-agent / Claude Skill ready.

Config-driven REST API authorization security scanner for detecting BOLA, BFLA, mass assignment, excessive data exposure, and privilege escalation.

Authorization security scanner for BOLA, IDOR, BFLA, relationship access control, and safe retesting.

Authorization / BOLA differential tester — replay captured requests across identities (owner/peer/lowpriv/unauth) and flag IDOR/BOLA, missing-auth, and privilege escalation. Zero-dependency Python, scope-gated, reads-only by default.

I made an easy docker build shell script for this. Intentionally vul API for hacking.

Scanner automatizado de vulnerabilidades em APIs REST, com detecção determinística baseada no OWASP API Security Top 10 (2023). TCC em Sistemas de Informação — UFV.