NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
Guided Lab: Hijacking a Tool Call to Access Unauthorized Data
A hands-on guided lab demonstrating how to exploit Broken Object Level Authorization (BOLA) by manipulating an LLM into generating tool arguments for restricted resources.
Room tasks
1Lab Setup and Target Overview
2Crafting the Hijack Prompt
3Verifying Unauthorized Data Access
Frequently Asked Questions
What is BOLA in an LLM application?
Broken Object Level Authorization occurs when an API trusts an object ID without checking ownership. If the LLM supplies that ID in a tool call, an attacker can steer it to another user's data.
How does tool call hijacking work?
The attacker uses prompt manipulation to change the arguments the model sends to a tool, for example swapping a user ID. If the backend does not verify permissions, unauthorized data is returned.
How do you defend against it?
Enforce authorization in the backend using the real user's identity, never trusting model-supplied IDs, and validate arguments strictly. You can practise the attack and the fix in this free guided lab.