Siemba Launches Automated IDOR Testing for APIs

• •Siemba's new tool automates IDOR testing for APIs, reducing testing time significantly.
• •IDOR vulnerabilities allow unauthorized access to user data and are a leading cause of API breaches.
• •The automated testing process requires no source code and validates findings through actual API responses.

Siemba has introduced automated testing for insecure direct object reference (IDOR) vulnerabilities in APIs, including REST, GraphQL, and SOAP. This capability allows for the testing of a 200-endpoint API collection in under an hour, significantly reducing the time compared to manual testing which can take days or weeks. IDOR is a critical authorization flaw that enables unauthorized access to user data by failing to verify if the identifier provided belongs to the caller. It is classified as broken object level authorization (BOLA) by OWASP and is ranked first in the OWASP API Security Top 10. Siemba's testing process involves reading actual API responses to confirm findings, ensuring that results are reliable and actionable. The automated system requires no source code and can handle authenticated sessions, making it a valuable tool for security teams. This innovation aims to help organizations address one of the most common causes of API breaches effectively.