I use REST for API Testing.
What are good tools and/or approaches to testing security issues ?
Any information through which I can broaden my perspective,ways,tools for testing when it comes to API.
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It only takes a minute to sign up.Sign up to join this community
That's a broad question. I recommend taking one or two resources and start exploring from there. You can find some ideas about API testing here and specifically if you ask about security, you can focus on OWASP API security
In general, some ideas relating to security:
X-Powered-By) with concrete name and even version.
I'm not a security expert, so my view is rather limited. What I've come in touch with is mostly a problem in one of these areas:
I've even seen situations where the whole database of higly sensitive medical data was stolen because an endpoint didn't implement any authentication and authorization, so simply incrementing an id in URL could give you all the resources. So it's wise to pay attention to these basics in the first place, because many of such attacks are very simple and could be done by virtually anyone with a browser.
This is a pretty broad question and depends greatly on the design of the API you test, it's security and what you want to achieve.
What is your experience level with api testing?
Do you have any existing tools to use?
Is it your own API? Do you have access to the API? at a code level?
What sort of vulnerability are you looking to prevent?