Posted on

The What, Why, and How of API Penetration Testing

I have come to realize and appreciate when having conversations about API Penetration Testing with colleagues and other professionals that not all understand what API is. Yes, sure it means an Application Programming Interface, and it is a software component that enables different systems/applications to interact with each other, but there is a bit more to its story...

  • The most common description for API is that it acts like a messenger to send a request from an entity (a person or an application) to another application and get a response.
  • The API is a system in itself; it is a toolset consisting of codes and commands that can be used across multiple applications, can be reused, and go a long way in making the lives of developers easy and productive, as they do not need to create code from scratch.
  • As a system/application user, we do not need to know what the API is made of. We simply make a request of the application, wait for the API and underlying application code to do their thing, and get a response.

If we had to draw a parallel with everyday life, let’s consider the post office. The postal system is a robust system in itself; made up of rules, codes, and policies, etc. that enable to function repeatedly for all mailing purposes.

Posted on

OWASP Top 10 API Security

I am sure that almost all of you would be aware about OWASP. But, just for the context let me just brief about the same.

OWASP is an international non-profit organization that is dedicated to web application security. It is a completely opensource and community driven effort to share articles, methodologies, documentation, tools, and technologies in the field of web application security.

Posted on

Penetration Test Types for (REST) API Security Tests

Black Box, Grey Box, and White Box Pen Tests

In my last article, we discussed Penetration tests, or pen tests, the importance of pen tests, and how it helps to find the REST API vulnerabilities. 

This article gives a brief overview of one of the pen tests type called white box pen tests. There are two more types called black box and grey box testing. However, black box and grey box penetration tests assume the tester has only limited knowledge about the target system, and this article focus is on API pen tests also discussed a few details on why it is a preferred test type of API penetration tests and summarized with a few tools that enable the pen tests for our APIs.