Siemba brings continuous IDOR testing to production APIs
Siemba released automated IDOR/BOLA testing for REST, GraphQL and SOAP APIs, checking a 200-endpoint collection in under an hour.
Siemba added automated insecure direct object reference (IDOR) testing to its API Security Testing capability, covering REST, GraphQL and SOAP APIs against the deployed service without source code. The platform validates findings by reading actual API responses and maps results to nine of the ten OWASP API Security Top 10 categories, with human testers handling broken function level authorization and chained attack paths. Testing starts from OpenAPI/Swagger files, Postman collections or collection URLs, with throttle presets and freeze windows for running against production.
- Tests 200-endpoint API collections for IDOR in under an hour
- Findings include reproduction steps, judged from actual API responses
- Covers GraphQL introspection, batching abuse, XXE and SOAP signature wrapping
- Maps results to nine OWASP API Security Top 10 categories
- Continuous testing targets production with throttling and freeze windows
- Products
- Siemba API Security Testing
- Organizations
- Siemba
From the original article
3 min read at helpnetsecurity.comSiemba has announced automated testing for insecure direct object reference (IDOR) as part of its API Security Testing capability, which tests REST, GraphQL and SOAP APIs for the vulnerability classes most likely to expose customer data. A 200-endpoint API collection can be tested for IDOR in under an hour.
By Industry News · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.