Modern web applications use Application Programming Interfaces (APIs) to manage user accounts, retrieve application data, access individual objects, and perform operations on application resources. These APIs commonly process object identifiers, such as user IDs, order IDs, product IDs, or resource identifiers, to determine which object a client is requesting.
Broken Object Level Authorization (BOLA) occurs when an API fails to verify whether the authenticated user has permission to access or modify a particular object. An attacker may manipulate an object identifier in an API request and attempt to access another user's resource.
BOLA is an important API security risk because successful exploitation may expose sensitive information or permit unauthorized modification of another user's data. Proper object-level authorization requires the application to verify access permissions for every relevant operation.
In this use case, OWASP Juice Shop is deployed within an isolated cybersecurity laboratory. Kali Linux is used as the controlled security-testing environment, while Ubuntu Linux hosts the application and machine-learning analysis workflow.
An existing public API security dataset is used as the data source for the machine-learning stage. The available records, labels, and request attributes are inspected to determine whether they support the proposed authorization-related classification task. Suitable labelled records are selected and processed to establish the features required for Decision Tree training.
A Decision Tree classifier, implemented using Scikit-learn, is used to classify API-request observations based on the patterns learned from the available labelled data. The model evaluates selected request characteristics and produces a classification that can help identify potentially suspicious API access activity.
The trained model is subsequently evaluated using compatible API requests captured during normal application activity and a controlled BOLA testing scenario against the local OWASP Juice Shop environment.
During the controlled test, requests are generated using authorized laboratory accounts. The test examines whether an authenticated test user can access an object that belongs to another test user without the required authorization. The requests and responses are captured and processed using the same feature-extraction procedure used during training.
The Decision Tree model classifies the processed request features, and its predictions are compared with the known authorization-test results. Suspicious requests are flagged for further investigation. The application’s actual authorization behavior is evaluated separately because a machine-learning prediction does not itself enforce object-level access control.
Application: OWASP Juice Shop
OWASP Juice Shop is an intentionally vulnerable web application designed for security training, awareness, and authorized security testing. It contains application security challenges and can be used to examine web and API security behavior within a controlled environment.
In this use case, OWASP Juice Shop provides the application environment for API access-control testing. The relevant API endpoints and object-access behavior must be examined before selecting a suitable BOLA test scenario.
APIs frequently accept object identifiers through request paths, query parameters, or request bodies. An application must verify that the authenticated user has permission to perform the requested operation on the identified object.
If the application checks authentication but fails to verify object ownership or access permissions, a user may be able to access resources belonging to another user.
Traditional security testing can identify authorization weaknesses through controlled request manipulation and response inspection. However, identifying suspicious access behavior across multiple requests may require additional analysis of request characteristics and authorization outcomes.
A machine-learning-based classification mechanism can provide supplementary detection by learning patterns from suitable labelled API security data. Its effectiveness depends on the quality of the dataset, the selected features, and the similarity between the training records and the application traffic being evaluated.
The proposed solution combines public-dataset-based Decision Tree training with controlled BOLA testing in OWASP Juice Shop. Captured requests are classified using the trained model, while the actual authorization outcome is verified independently using the known laboratory test conditions.
Specific Attack: Controlled Broken Object Level Authorization Attack Against OWASP Juice Shop
The controlled attack scenario evaluates whether an authenticated test user can access an object that belongs to another test user by manipulating an object identifier in an API request.
OWASP Juice Shop is deployed within the isolated laboratory environment. Kali Linux is used as the authorized security-testing system, while OWASP ZAP and cURL support request inspection and controlled HTTP testing.
The test uses separate laboratory accounts and application resources. A legitimate request is first generated to establish the normal access behavior. A controlled request is then modified to reference a different test user's object, where the application exposes a suitable test scenario.
The application response is inspected to determine whether the requested object is accessible to the authenticated user. An unauthorized access attempt is not automatically considered successful BOLA exploitation; the response and actual object-access result must support that conclusion.
The captured requests and their associated metadata are processed using the same feature-extraction workflow established for the machine-learning model.
The Decision Tree classifier evaluates the prepared request features and produces a prediction based on the classes learned during training. The prediction is compared with the independently verified authorization-test result to evaluate detection effectiveness.
Decision Tree-Based Detection of BOLA Through API Access-Control Analysis
The primary security concept is Supervised Machine-Learning-Based Detection of Suspicious API Authorization Activity.
The first objective is to identify an existing public API security dataset containing suitable labelled records for the intended classification task. The dataset is inspected to determine whether its labels and request attributes represent authorization-related behavior that can support the proposed experiment.
The second objective is to transform the selected records into numerical features. These features may represent available request characteristics, object-related information, authentication context, response status, and other attributes that can be extracted consistently from the selected data.
The third objective is to train a Decision Tree classifier using the prepared features and verified labels. The model learns classification rules from the training examples and applies them to compatible unseen request observations.
The fourth objective is to validate the model using normal API requests and a controlled BOLA test performed against OWASP Juice Shop. The model's predictions are compared with independently verified authorization outcomes.
The final objective is to evaluate whether the Decision Tree can identify suspicious authorization-related activity under the tested conditions and to document its limitations.
The security concept defines the overall security strategy.
The following are the specific defensive mechanisms implemented.
An existing public API security dataset is inspected and processed to identify suitable labelled records.
Relevant request and response characteristics are transformed into a numerical representation compatible with the Decision Tree classifier.
The trained Decision Tree classifies API-request observations according to patterns learned from the labelled training records.
Controlled requests are examined to determine whether the authenticated user is permitted to access the requested object.
Requests classified as suspicious are marked for further security investigation.
The classification results are compared with the independently verified outcomes of the controlled BOLA test.
The predictions are compared with suitable ground-truth labels and verified laboratory test results.
The application must perform an appropriate object-level authorization check for each protected operation. If the test identifies a missing authorization control, the application-side control must be corrected or an appropriate enforcement mechanism implemented.
OWASP Juice Shop provides the application environment for controlled API security testing.
Kali Linux provides the controlled security-testing environment.
Ubuntu Linux hosts the application and machine-learning analysis components according to the laboratory configuration.
VirtualBox provides the isolated laboratory infrastructure.
OWASP ZAP is used to inspect HTTP requests and responses associated with the local application.
cURL is used to send reproducible HTTP/API requests to the authorized laboratory application.
Nmap is used to identify services exposed by the authorized laboratory environment.
Python provides the primary implementation environment for the classification and validation workflow.
Scikit-learn provides the Decision Tree classification implementation and evaluation utilities.
Pandas is used to load, filter, transform, and organize the existing public dataset and captured API records.
NumPy supports numerical operations during feature preparation and model processing.
An existing public API security dataset is used as the data source for the classification experiment. Its available records, labels, metadata, and usage terms are reviewed to determine whether it supports authorization-related classification.
SQLite provides local storage for captured requests and classification results.
OWASP Juice Shop is deployed within an isolated VirtualBox laboratory to provide a controlled environment for API access-control testing.
An existing public API security dataset is obtained and inspected to determine whether its records, labels, and request attributes support the intended BOLA-related classification task.
Suitable labelled records are selected and processed into numerical features for Decision Tree training, without manually fabricating the primary training dataset.
The Decision Tree classifier is trained using the selected labelled records and evaluated against held-out data to measure its classification performance.
Normal API activity is generated and captured from the local OWASP Juice Shop application, establishing request-level evidence for the controlled authorization assessment.
A controlled BOLA testing scenario is performed using authorized laboratory accounts to examine whether object-level authorization is enforced when a request references another test user's resource.
The captured requests are processed using the established feature-extraction workflow and classified by the trained Decision Tree model.
The model predictions are compared with independently verified authorization-test outcomes to evaluate whether the selected features help identify suspicious object-access activity.
SQLite stores the relevant request metadata, classification predictions, verified authorization outcomes, and evaluation results in a structured format
The complete workflow demonstrates public-dataset assessment, supervised Decision Tree training, controlled BOLA attack simulation, API request capture, authorization verification, suspicious-access classification, and final detection validation. The results document the model's effectiveness and limitations while distinguishing anomaly or attack detection from actual authorization enforcement and prevention.
Research Breakthrough Possible @S-Logix