API Security Testing
Principles for testing API security. OWASP API Top 10, authentication, authorization testing.
OWASP API Security Top 10
| Vulnerability | Test Focus |
|---|---|
| API1: BOLA | Access other users' resources |
| API2: Broken Auth | JWT, session, credentials |
| API3: Property Auth | Mass assignment, data exposure |
| API4: Resource Consumption | Rate limiting, DoS |
| API5: Function Auth | Admin endpoints, role bypass |
| API6: Business Flow | Logic abuse, automation |
| API7: SSRF | Internal network access |
| API8: Misconfiguration | Debug endpoints, CORS |
| API9: Inventory | Shadow APIs, old versions |
| API10: Unsafe Consumption | Third-party API trust |
Authentication Testing
JWT Testing
| Check | What to Test |
|---|---|
| Algorithm | None, algorithm confusion |
| Secret | Weak secrets, brute force |
| Claims | Expiration, issuer, audience |
| Signature | Manipulation, key injection |
Session Testing
| Check | What to Test |
|---|---|
| Generation | Predictability |
| Storage | Client-side security |
| Expiration | Timeout enforcement |
| Invalidation | Logout effectiveness |
Authorization Testing
| Test Type | Approach |
|---|---|
| Horizontal | Access peer users' data |
| Vertical | Access higher privilege functions |
| Context | Access outside allowed scope |
BOLA/IDOR Testing
- Identify resource IDs in requests
- Capture request with user A's session
- Replay with user B's session
- Check for unauthorized access
Input Validation Testing
| Injection Type | Test Focus |
|---|---|
| SQL | Query manipulation |
| NoSQL | Document queries |
| Command | System commands |
| LDAP | Directory queries |
Approach: Test all parameters, try type coercion, test boundaries, check error messages.
Rate Limiting Testing
| Aspect | Check |
|---|---|
| Existence | Is there any limit? |
| Bypass | Headers, IP rotation |
| Scope | Per-user, per-IP, global |
Bypass techniques: X-Forwarded-For, different HTTP methods, case variations, API versioning.
GraphQL Security
| Test | Focus |
|---|---|
| Introspection | Schema disclosure |
| Batching | Query DoS |
| Nesting | Depth-based DoS |
| Authorization | Field-level access |
Security Testing Checklist
Authentication:
- Test for bypass
- Check credential strength
- Verify token security
Authorization:
- Test BOLA/IDOR
- Check privilege escalation
- Verify function access
Input:
- Test all parameters
- Check for injection
Config:
- Check CORS
- Verify headers
- Test error handling
Remember: APIs are the backbone of modern apps. Test them like attackers will.