AuthzBOLA

authenticated IDOR / BOLA · you seed accounts, it hunts

1. Guided programs

1. Click a program name to open its policy — confirm it allows automated testing with multiple accounts, and find the sign-up page. 2. Create two accounts on that app (tip: [email protected] / [email protected] both reach your inbox). 3. Hit USE — it fills the scope hosts and a login-URL guess; check the login URL, add the two logins, Save.

ProgramPlatformFindingsMax
Loading…

2. Add target

3. Seeded targets

ProgramLoginAB
Loading…

4. Hunt

The platform runs the exploiter on the box — no terminal. Test login first (logs in both accounts, captures, sends no attacks). If it logs in clean, Hunt replays A’s requests as B. Only run against programs that permit automated testing.

eko-ii · authz
HomeAgentsPrograms