research & field notes

Technical breakdowns, vulnerability research, adversary simulation playbooks, and practical defense guidance written by practising security engineers.

All Articles Threat Intelligence Penetration Testing Cloud Security Red Teaming Vulnerability Research Application Security Digital Forensics & OSINT Security Advisory

Exploiting Broken Object Level Authorization (BOLA/IDOR) in Modern Financial APIs

Penetration Testing

9 min read 22 Sep 2026

Exploiting Broken Object Level Authorization (BOLA/IDOR) in Modern Financial APIs

How attackers exploit subtle authorization flaws in REST and GraphQL endpoints to drain customer balances and hijack merchant records, and why Web Application Firewalls (WAFs) fail to detect them.

Kelechi Okafor · 22 Sep 2026

Read →

Start a Conversation

Need offensive testing for your organisation?

A twenty-minute call is usually enough to tell whether we are the right fit. If we are not, we will say so.

send a message → chat on WhatsApp