HOW TO DO API PENETRATION TESTING

We are asked often to test clients API’s and the demand doesn’t seem to be slowing. As more and more applications need to “talk” with other applications API’s have become a major attack vector for shady characters and the need for extensive testing is paramount. Whether you’re looking at how to pentest an API, how to discover nodejs API structures, or how to pentest rest API’s, we hope that you find this information helpful.

Why Get an API Penetration Test?

You should use an expert application programming interface (API) penetration tester to help Application Security Professionals identify and prioritize cyber security threats. You can do this without stressing your budget or having to become a specialized security expert yourself.

These testers can supplement your existing security efforts, so you can determine and safely identify a quantifiable level of threat. They can help you navigate and resolve vulnerabilities and gaps, and comply with local, state, and federal regulatory requirements.

Enhanced Clarity & Significantly Improved Security

All of this comes at a reasonable price that allows you to leverage our best practices, technical expertise, and scalable infrastructure.

API Pentest Service Levels

APIs are generally tested in conjunction with networks, applications, IoT devices, ICS/SCADA, databases, mobile, WIFI, Web Services, and almost anything else you may need to be tested. Additionally, you can test as HEAVY or as light as you prefer. Typical testing levels can include:

• Level 0: Vulnerability Scan

• Level 1: Vulnerability Assessment

• Level 2: Penetration Test (default)

• Level 3: Expanded Pentest

API Pentest Phases API Reconnaissance Phase

• Represents the information gathering and enumeration phase of an attack

• Data is collected passively from applications through automated and manual means

• Application functionality is determined and documented through a combination of calls submissions, sample project package (POSTMAN, SOAP, etc.) analysis, and WS/API documentation reviews

• Key parameters are documented and noted for exposure / further follow on

• Web service application traffic is passed through a proxy and interrogated for further detail

API Verification Phase

• Represents the vulnerability identification and validation phase of an attack

• Key components of the web services application are tested (including Active Fuzzing) for vulnerabilities and exposures. These include:

• Authentication, Authorization & Roles (Privileges and Permissions)

• Data Input Validation, Handling & Processing

• Encryption & Sequencing

• Business Logic, Source Code & Parameter Manipulation

• Includes automated and manual identification

• Culminates with validation of vulnerabilities that can or may be exploited

API Exploitation Phase

• Represents the exploitation and compromising phase of an attack

• Leverages vulnerabilities identified in the earlier phase(s) to successfully penetrate security controls

• Includes mostly manual attacks with semi-automated support

• Concludes with tester gaining access to web services application data and/or permissions (access) not previously available to the tester

• In some cases, exploitation of web services may not be possible given the security controls present, the complexity of the attack (undocumented, or not enough documentation/context), and the time allotment for testing

Comprehensive API Penetration Testing (Sample)

• Fuzzing

• Identification, Authentication & Authorization

• Encryption / SSL and data security (in-flight, at-rest)

• Other communication protection mechanisms (freshness)

• Web service chains

• Parameter tampering

• Schema validation

• Content validation

• Output encoding

• Malicious code / Virus protection

• Command / Client-side injection (XSS, CSRF, HTML, XPath, XXE, etc.) – particularly for upstream or downstream consumers

• Message size

• DoS protection and availability

• Business logic errors

SUMMARY It’s important that you find a tester who doesn’t just use a tool. It’s easy to think that running Burpsuite or some other tool is “good enough” but if you’re looking for real security you need somebody who is certified in many areas that can test your solutions to the appropriate depth. Not all testers are created equal. For a free service consultation, contact us at: www.emagined.com or give us a call!