API3:2023 — Broken Object Property Level Authorization

Slide 7 · The Attackers

You don't need special skills. You need curiosity.

Three types of people who find these vulnerabilities — and how.

🧑‍💻

The Developer Exploring an API

Egor Homakov was a developer. He read the documentation, understood the data model, and noticed a field that shouldn't have been bindable. Most BOPLA discoveries start with someone curious about what the API actually accepts or returns.

🔍

The Response Inspector

Opens browser dev tools or a proxy like Burp Suite. Looks at raw API responses instead of what the UI displays. Finds fields the frontend hides: password hashes, internal IDs, admin flags, tokens. No exploit needed — just reading what the server already sends.

🧪

The Field Fuzzer

Takes a known API request body and adds extra fields — isAdmin, role, verified, balance, approved — one by one. Watches to see if the server returns a 200 and if the change actually took effect. Systematic and automatable.

The uncomfortable truth

These vulnerabilities are often found by your own developers, security researchers doing responsible disclosure, or — if you're unlucky — by someone browsing your app out of curiosity. The attacker doesn't need to "hack" anything. They just need to read or send a JSON field.

← Back Why is this ranked #3? →