API Penetration Testing

Application program interfaces (APIs) provide essential functions and access to data for today’s full-featured applications and integrations. Unfortunately, if they’re not well-architected, expertly implemented, and thoroughly tested, these APIs can be a back door around security.

Effective API penetration testing requires a diligent effort to find weaknesses — attackers are relentless, so testing should be too. Whether you use a SOAP, REST, or custom API, it’s critical that every endpoint be carefully evaluated. We don’t rely on vulnerability scanning or static techniques and assessment methods, but rather analyze each endpoint to predict areas of weakness and then attempt to validate their existence.

1. Understand the attack surface, including users, roles, resources, and responses.
2. Thoroughly test authentication methods, and access provided without authentication.
3. Evaluate possible existence of Insecure Direct Object References (IDOR).
4. Examine possibilities for Server-Side Request Forgery (SSRF).
5. Try XML entity-based attacks.
6. Test IDs in response body and headers.
7. Try injection-based attacks.
8. Look for API security misconfiguration (CORS, error messages, etc.).
9. Look for data leakage in API responses.

Every API is different, and we approach every new API penetration test with an eagerness to understand and learn about potential weaknesses.