API Penetration testing
APIs hold the keys to your most valuable information
Hackers often find APIs as easy targets
APIs come in many flavors but often are plagued by security vulnerabilities. Using blended attack techniques, Raxis scrutinizes each API endpoint and parameter for anomalies. We do this through direct interaction and by manipulating application data in flight manually with advanced testing tools. We test and verify potential insertion points with a focus on session management, data integrity, and parameter fuzzing – varying inputs to see if we get unexpected results.
How Raxis conducts API penetration tests
Like all of our assessments, API pentests can be tailored to your specific needs. Every API test performed by Raxis is a true manual breach attempt. While we use tools to help us identify key areas, the majority of testing is performed manually. Our engineers test the business logic of the API in an effort to escalate privilege, force data leaks, expose sensitive information, and in extreme cases make the leap from the application into other environments.
We hunt for flaws in the login process as well as authentication bypass techniques such as SQL injection (SQLi) and session fixation. Anything from user enumeration and brute-force attacks to insecure direct object references (IDOR) are considered in-scope.
Once authenticated, Raxis looks for technical vulnerabilities as well as business logic gaps and flaws. Configuration issues, data sanitization flaws, and session issues are just a few of the areas our engineers will test.
Software as a Service (SaaS) customers often require testing to validate that the customers who use the API are not able to access other customers’ data. Raxis pentesters look for vulnerabilities that could allow these flaws and work to exploit them.
When setting the scope, you choose how many roles Raxis will test. Testing as a user with limited permissions makes it possible for our engineers to attempt actions, such as accessing data that should only be available to higher-privileged users.
Originally developed by Facebook, GraphQL started development in 2012 and released to open source in 2015. Many public APIs are now using GraphQL and it’s becoming more popular each day.
Representational State Transfer, or REST, has been in use since around 2000 and is one of the most used APIs among developers. REST is estimated to comprise about 90% of the APIs in use today.
Simple Object Access Protocol, known as SOAP, is a highly structured method of implementing application communication endpoints using XML. SOAP was originally made available for use in 1999.
You have questions. wE have answers.
API Penetration Testing
Yes, these tests are important tools for your development team. APIs often power organizations’ web and mobile applications. Many organizations also release external APIs so that their customers can access and modify the data from within their own applications. All of these APIs benefit from penetration testing, and, in many cases, our customers’ clients request proof of pentest remediations before agreeing to use an API within their own applications.
Raxis pentesters have the experience to thoroughly test your API as a malicious actor would:
- REST (Representational State Transfer) infrastructure
- SOAP (Simple Object Access Protocol) infrastructure
Our engineers jump in during the testing phase of your dev team’s secure software development lifecycle (SDLC). Instead of looking at your API as a credible user would, they take a hacker’s point of view, attempting to exploit business logic vulnerabilities as well as code and configuration issues. Raxis gives your development team useful, actionable feedback to give them to tools they need to secure your application.
We highly recommend that it is. Raxis customers approach this with:
- Static testing for new APIs
- Ongoing testing for APIs in continuous development
- Periodic testing for APIs with scheduled updates
In 2019 OWASP created a separate Top Ten list for APIs. While it’s related to the OWASP Top Ten, the OWASP API Top Ten focuses on different areas, and Raxis uses it as a guideline for our API tests.
The 2019 OWASP API Top Ten
- API1:2019 Broken Object Level Authorization
- API2:2019 Broken User Authentication
- API3:2019 Excessive Data Exposure
- API4:2019 Lack of Resources & Rate Limiting
- API5:2019 Broken Function Level Authorization
- API6:2019 Mass Assignment
- API7:2019 Security Misconfiguration
- API8:2019 Injection
- API9:2019 Improper Assets Management
- API10:2019 Insufficient Logging & Monitoring
We recommend an API test in addition to a web application test, especially if your API is used by multiple applications, whether internal or external. Depending on your scope and budget, a combined test may be a good option.
APIs focus on functionality to provide data and data updates to applications, but they open organizations to a different area of attack. Raxis API pentests look at your API as a hacker would, focusing not on application needs but instead on unintentional openings within the API.