IDOR/BOLA Assistant v3.1.0 focuses on reducing passive-discovery false positives.
Highlights:
- Evidence-qualified candidate scoring with Active and Suppressed dispositions.
- Authentication-context headers and cookies, pagination, telemetry, and symbolic GraphQL variables no longer become normal candidates from weak signals.
- Reviewable Suppressed workspace with repeated-observation promotion.
- Reversible endpoint- and host-scoped false-positive and allow rules.
- Rules persist metadata selectors only; raw identifiers and HTTP messages are never stored.
- 67 automated tests with 93.5% core line coverage.
Install:
Download idor-bola-assistant-3.1.0.jar and load it as a Java extension in Burp Suite.