# Guided Lab: Hijacking a Tool Call to Access Unauthorized Data

> A hands-on guided lab demonstrating how to exploit Broken Object Level Authorization (BOLA) by manipulating an LLM into generating tool arguments for restricted resources.

Canonical: https://codelivly.com/rooms/guided-lab-hijacking-a-tool-call-to-access-unauthorized-data
Last updated: 2026-10-12

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 100 |

This guided lab provides a practical, step-by-step walkthrough of achieving Broken Object Level Authorization (BOLA/IDOR) via an LLM tool call. You will chain "QA Testing" prompt frames with precise parameter manipulation to bypass the LLM's safety filters, successfully tricking the model into generating a tool call that retrieves a highly confidential document belonging to another user.

## Lessons

1. Lab Setup and Target Overview (30 min)
2. Crafting the Hijack Prompt (30 min)
3. Verifying Unauthorized Data Access (30 min)

## Related

- [Learning path: AI API and Function-Calling Attacks](https://codelivly.com/learning-paths/ai-api-and-function-calling-attacks)
- [All rooms](https://codelivly.com/rooms)