API Broken Object Level Auth Scanner
Tests for BOLA/IDOR vulnerabilities in REST APIs.
What is API Broken Object Level Auth?
Broken Object Level Authorization (BOLA), also known as IDOR (Insecure Direct Object Reference), occurs when APIs don't verify that users have authorization to access the specific objects they request. Attackers can access other users' data by simply changing IDs in API requests.
Why is This Important?
BOLA is the #1 API security risk (OWASP API Top 10). It enables mass data exfiltration, privacy breaches, and account compromise. Because APIs typically use predictable IDs and return structured data, exploitation is trivial and automated scraping of all user data is common.
How It Works
1. API Discovery
Automatically discovers API endpoints, methods, parameters, and authentication mechanisms from documentation or traffic.
2. Security Testing
Tests for OWASP API Top 10 vulnerabilities including broken authentication, excessive data exposure, and injection flaws.
3. Compliance Validation
Validates API security against industry standards with detailed findings and remediation guidance.
Key Capabilities
Complete API security coverage aligned with OWASP API Security Top 10 and industry best practices.
- Automatic API endpoint discovery
- Authentication and authorization testing
- Rate limiting and resource exhaustion checks
- Data exposure and sensitive info detection
- API versioning and deprecation analysis
Frequently Asked Questions
How do I test for BOLA vulnerabilities?
Testing: change object IDs in requests to access other resources, enumerate IDs (sequential numbers, UUIDs from other contexts), use multiple test accounts and swap IDs between them, automate testing across all endpoints with objects, and check that 403/404 is returned for unauthorized access.
What makes BOLA so common?
BOLA is common because: authorization checks are easily forgotten, it requires per-endpoint implementation, object ownership isn't always obvious, developers assume UI controls prevent access, and testing requires multiple accounts to verify isolation.
Do UUIDs prevent BOLA?
No. UUIDs add obscurity but not security. UUIDs can be leaked in URLs, logs, emails, or other API responses. Once known, they're just as exploitable as sequential IDs. Proper authorization checks are still required for every request.
How do I prevent BOLA?
Prevention: implement authorization checks on every object access (not just UI), verify the requesting user owns/has access to the requested object, use framework-provided authorization, create reusable authorization middleware, implement object-level permissions, and extensively test with multiple accounts.
Related Scanners
Ready to secure your application?
Start testing for api broken object level auth vulnerabilities today.
Get Started Free