-1

I use REST for API Testing.

What are good tools and/or approaches to testing security issues ?

Any information through which I can broaden my perspective,ways,tools for testing when it comes to API.

Improve this question
2
  • 2
    Your question will probably be closed, due to not be specific. I would suggest reading the How to Ask a Good Question guide (sqa.stackexchange.com/help/how-to-ask) and re-phrase your question accordingly.
    – João Farias
    Feb 26, 2021 at 16:20
  • Updated title to reflect content and also improved content
    – Michael Durrant
    Feb 27, 2021 at 10:07

2 Answers 2

Reset to default
3

That's a broad question. I recommend taking one or two resources and start exploring from there. You can find some ideas about API testing here and specifically if you ask about security, you can focus on OWASP API security

In general, some ideas relating to security:

  • authentication: what endpoints could be used only when authenticated? are there some that do not implement it correctly? what authentication do we implement?
  • authorization: are there some resources some users can't have access to? what are they? what users are we talking about?
  • data leakage: also related to previous two points; do we leak some data through errors? 500 and stack traces all over the response body are common; is it a problem? what data do we leak like this? what about headers? some technologies send custom headers (e.g. X-Powered-By) with concrete name and even version.
  • mass assignment: could we add more properties than we are supposed to?
  • denial of service: does we need rate limiting or some other method of preventing this attack?
  • injections: SQL injections, command injections
  • etc.

I'm not a security expert, so my view is rather limited. What I've come in touch with is mostly a problem in one of these areas:

  • wrong authentication
  • wrong authorization
  • mass assignment
  • overly verbose error messages

I've even seen situations where the whole database of higly sensitive medical data was stolen because an endpoint didn't implement any authentication and authorization, so simply incrementing an id in URL could give you all the resources. So it's wise to pay attention to these basics in the first place, because many of such attacks are very simple and could be done by virtually anyone with a browser.

Improve this answer
-1

This is a pretty broad question and depends greatly on the design of the API you test, it's security and what you want to achieve.

What is your experience level with api testing?

Do you have any existing tools to use?

Is it your own API? Do you have access to the API? at a code level?

What sort of vulnerability are you looking to prevent?

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.