Authorization & Isolation Red Teaming

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R02 — ASVS

   R03 — API BOLA

   R13 — Qdrant

   R24 — LangGraph

   R05 — ATLAS

   R11 — HF

   R21 — MCP

   R37 — SLSA

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Execute cross-project BOLA/IDOR, vector tenant filter bypass, D4 PII vault cross-session access, P1/P3 memory & checkpoint replay, cache poisoning, and D7 delegated OAuth token escalation attacks.

   Execute model artifact byte-tampering (D12), dataset lineage drift, D5 RAG document poisoning & citation spoofing, D10 vector sleeper triggers, and D2 MCP tool-description rug-pull attacks.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 91 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Authorization/isolation and poisoning/provenance red-team findings log.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R02OWASP ASVS↗ owasp.org

  Access-control, validation, authentication, file-handling, and logging requirements.

• R03OWASP API Security Top 10↗ owasp.org

  BOLA (API1), Broken Auth (API2), Unrestricted Resource Consumption (API4), SSRF (API7), Misconfiguration (API8).

• R05MITRE ATLAS↗ atlas.mitre.org

  ML attack tactics/techniques: prompt injection, data poisoning, model extraction, and exfiltration.

• R11Hugging Face Documentation↗ huggingface.co

  Model cards, tokenizer/config files, embedding usage, and repository commit-hash revision pinning.

• R13Qdrant Documentation↗ qdrant.tech

  Collections, payload metadata indexing, pre-filtering, multitenancy partitioning, and snapshots.

• R21Model Context Protocol (MCP)↗ modelcontextprotocol.io

  Official specification: client/server lifecycle, JSON-RPC messages, tool discovery, authorization, and trust boundaries.

• R24LangGraph Documentation↗ docs.langchain.com

  State graphs, durable checkpointing, human-in-the-loop interrupts, retries, and resumability.

• R37SLSA & Sigstore↗ slsa.dev

  Supply-chain Levels for Software Artifacts (SLSA), build provenance attestations, and Cosign artifact signing.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP
  OWASP Top 10 API Security Risks – 2023

  The full risk table including BOLA (API1), broken auth (API2), unrestricted resource consumption (API4) and SSRF (API7), the checklist for the cross-project authorization sweep.

  R03moved 2026-11-11
• videoInsiderPhD · 29:43
  New OWASP API Top 10 for Hackers

  A security researcher's walkthrough of exploiting each API risk, aimed at attackers' reasoning, which is what you need to attempt BOLA and tenant-filter bypass rather than just read the list.

  R03checked 2026-11-11
• videoHacktilizer · 15:52
  Broken Object Level Authorization (BOLA) - Video 1: API Hacking with OWASP API Top 10 2023

  Focused BOLA exploitation demo: swapping object identifiers to reach another tenant's record, the exact technique to replay against your vector filters and D4 PII vault.

  R03checked 2026-11-11
• articleOWASP
  API1:2023 - Broken Object Level Authorization

  Details why object-level checks must live in every function that touches a user-supplied ID, the prevention pattern for both P1 endpoints and per-tenant vector queries.

  R03moved 2026-11-11
• repoGitHub
  OWASP/crAPI

  A deliberately vulnerable microservice API with a chatbot component, giving you a legal local target for BOLA, resource-consumption and token-escalation practice before hitting your own services.

  R03checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.