APIs now power the vast majority of web, mobile, and microservice communications. According to the OWASP API Security Top 10, the number one vulnerability plaguing modern digital applications is API1:2023 Broken Object Level Authorization (BOLA), commonly referred to as Insecure Direct Object References (IDOR).
BOLA occurs when an API endpoint accepts an object identifier (such as /api/v1/invoices/10492) without verifying that the authenticated user making the request actually owns that object.
Traditional vulnerability scanners fail completely at detecting BOLA because detecting authorization bypasses requires state-aware multi-user credential testing.
The Multi-Role Testing Matrix: To catch BOLA, Lory is provisioned with pairs of test accounts across user tiers. Lory authenticates as User A, queries an endpoint to harvest object identifiers, and then re-submits the request using User B’s session token to verify if cross-tenant data isolation holds.
How Lory Audits REST and GraphQL APIs
1. OpenAPI & Postman Schema Ingestion
Lory ingests OpenAPI (Swagger) files, Postman collections, or discovers routes automatically via Layer 3 endpoint crawling. It maps all query parameters, request bodies, and authentication headers into structured test vectors.
2. Autonomous BOLA & IDOR Verification
Lory’s Layer 2 engine systematically mutates identifiers (UUIDs, sequential integers, hashes) across state-changing HTTP methods (GET, PUT, DELETE, PATCH), verifying that unprivileged users cannot read or overwrite foreign tenant records.
3. Mass Assignment & Privilege Escalation
Lory tests whether injecting administrative fields (such as "is_admin": true or "role": "superadmin") into registration or profile update payloads results in unauthorized privilege elevation.
4. GraphQL In-Depth Exploitation
Lory audits GraphQL endpoints for introspection leakage, deep nested recursive queries that cause CPU exhaustion, and query batching attacks used to bypass rate limiting.
Audit Deliverables That Satisfy Enterprise Buyers
Every API finding is formatted with full HTTP request headers, parameter schemas, response proofs, and exact curl commands. Human-verified by Lorikeet Security’s offensive engineers, your API report provides undeniable proof for compliance auditors and enterprise procurement.
Secure Your REST & GraphQL APIs with Lory
Eliminate BOLA and authorization bypasses across your API ecosystem. Schedule an autonomous API penetration test with Lorikeet Security.
