API APPLICATION PENTESTING

API (Application Programming Interface)

An Application Programming Interface (API) is a set of software functions and
procedures that allow two applications to communicate with each other without
direct user involvement. APIs provide the means for different software systems
to interact, enabling the exchange of data and functionality in a structured and
predictable manner. In essence, an API serves as a messenger, relaying requests
between a client and a system, then returning the corresponding response.

Key Concepts:

 Interface for Interaction: APIs provide a structured communication

method between software components, akin to a user interface for
humans.
 Standardization: APIs standardize the way requests are made and
responses are received, ensuring reliable integration.
 Abstraction: APIs abstract underlying complexities, enabling developers
to use functionalities without needing to understand the intricate details
of the implementation.
 Endpoints and Methods: APIs expose specific endpoints (URLs) and
methods (such as GET, POST, PUT, and DELETE) that define how
operations are performed and resources are accessed.
 Data Formats: APIs typically use standardized data formats, such as JSON
or XML, for exchanging information.
 Security: Security measures like authentication and authorization are
often included to ensure that only authorized users can access the
services.

Types of APIs
APIs can be classified into various categories based on their functionality, usage,
and implementation. Here are the main types of APIs, along with examples:

1. Open APIs (Public APIs):

o Definition: These APIs are available to external developers with
minimal restrictions, intended for broader usage by developers
from different organizations.
o Example:
 Twitter API: Allows developers to interact with Twitter data,
such as retrieving tweets and accessing user information.
  Google Maps API: Enables developers to embed Google
Maps into web pages and applications, providing map
functionalities like directions and geocoding.
2. Internal APIs (Private APIs):
o Definition: Designed for internal use within an organization, these
APIs connect systems and data within the company and are not
exposed to external users.
o Example:
 HR System API: An internal API used within an organization
to integrate different human resource management systems.
 Internal Microservices: APIs that enable communication
between various microservices within a company.
3. Partner APIs:
o Definition: Externally shared APIs that are accessible to specific
business partners, facilitating B2B interactions.
o Example:
 Expedia Affiliate Network API: Provides partners with access
to Expedia's booking capabilities.
 PayPal Partner API: Allows merchants to integrate PayPal's
payment processing services.
4. Composite APIs:
o Definition: These APIs combine multiple APIs into a single call,
particularly useful in microservices architectures where data from
several sources is required.
o Example:
 Ordering System API: Combines information from inventory,
shipping, and billing APIs to complete an order.
 Social Media Aggregator API: Merges data from multiple
social media platforms into a single response.
5. REST APIs (Representational State Transfer):
o Definition: REST APIs use HTTP requests to perform CRUD (Create,
Read, Update, Delete) operations and are known for their simplicity
and statelessness.
o Example:
 GitHub REST API: Allows developers to manage GitHub
repositories, issues, and pull requests.
 Spotify API: Provides access to Spotify's music catalog.
6. SOAP APIs (Simple Object Access Protocol):
 o Definition: SOAP APIs use an XML-based protocol to facilitate
network communication and are known for their robustness and
security features.
o Example:
 Salesforce SOAP API: Integrates Salesforce CRM
functionalities.
 PayPal SOAP API: Enables access to PayPal's payment
services.
7. GraphQL APIs:
o Definition: A query language for APIs that allows clients to request
specific data, making it more efficient and flexible.
o Example:
 GitHub GraphQL API: Allows customized queries and
manipulation of GitHub resources.
 Shopify API: Manages online stores through customizable
queries.
8. WebSocket APIs:
o Definition: WebSocket APIs provide real-time data transfer over a
persistent connection between client and server.
o Example:
 Binance WebSocket API: Delivers real-time market data for
cryptocurrency trading.
 Slack Real-Time Messaging API: Facilitates real-time
messaging in Slack applications.

API Architecture
API architecture refers to the structural design framework that implements an
API. It is akin to the TCP/IP protocol layers, where each layer has distinct
responsibilities, working together to enable tasks on another system. API
architecture ensures that APIs are robust, secure, scalable, and easy to manage.

Key Layers of API Architecture:

1. Presentation Layer:
o Function: Manages the communication between the API and its
consumers, ensuring that the API's endpoints are accessible and
user-friendly.
o Components:
 Endpoints: URLs for client interaction.
  Authentication and Authorization: Verifying user identity
and controlling access.
 Rate Limiting: Preventing abuse by limiting the number of
requests a client can make.
2. Business Logic Layer:
o Function: Contains the core functionality of the API, processing
requests according to business rules.
o Components:
 Controllers: Handle incoming requests and process them.
 Services: Reusable components that encapsulate business
logic.
 Validation: Ensures incoming data meets criteria before
processing.
3. Data Access Layer:
o Function: Manages interactions with databases or other data
sources, retrieving and storing data as needed.
o Components:
 Repositories/DAOs: Abstract data access logic.
 ORM (Object-Relational Mapping): Simplifies database
operations by mapping database tables to objects in code.
4. Integration Layer:
o Function: Facilitates communication with external systems,
services, or APIs.
o Components:
 API Clients: Interfaces for calling external APIs.
 Message Brokers: Facilitate asynchronous communication.
5. Security Layer:
o Function: Protects the API from security threats and ensures secure
data handling.
o Components:
 Authentication and Authorization: Verifying identities and
controlling access.
 Encryption: Securing data in transit and at rest.
 Input Validation and Sanitization: Preventing common
attacks.
6. Management Layer:
o Function: Provides tools for managing and monitoring the API,
ensuring efficiency and reliability.
o Components:
  API Gateway: Acts as an entry point, providing load
balancing and security features.
 Monitoring and Analytics: Tools to track usage and
performance.
7. Infrastructure Layer:
o Function: Supports the underlying hardware and software
infrastructure of the API.
o Components:
 Servers and Hosting: Where the API is deployed.
 Load Balancers: Distribute requests to ensure high
availability.

REST vs. SOAP APIs

REST (Representational State Transfer) API:

 Overview: An architectural style that relies on a stateless, client-server,

cacheable communications protocol (typically HTTP).
 Key Characteristics:
o Statelessness: Each request contains all the information needed for
processing.
o Client-Server Architecture: The client and server operate
independently.
o Cacheable: Responses are marked as cacheable or non-cacheable.
 Example:
o Bookstore API: Endpoints like GET /books retrieve book lists, POST
/books adds new books, etc.

SOAP (Simple Object Access Protocol) API:

 Overview: A protocol for exchanging structured information in web

services using XML.
 Key Characteristics:
o Protocol-based: Strict standards ensure consistency.
o XML Messaging: Ensures platform independence.
o Extensibility: Supports additional protocols and technologies.
 Example:
o Salesforce SOAP API: Manages CRM functionalities.
Advantages and Disadvantages:

 REST:
o Advantages: Simplicity, scalability, and flexibility.
o Disadvantages: Statelessness can lead to overhead; lack of strict
standards.
 SOAP:
o Advantages: Standardization, security, and reliability.
o Disadvantages: Complexity and slower performance due to XML
messaging.

API Penetration Testing Process

API penetration testing is a specialized security assessment that aims to identify
and exploit vulnerabilities within Application Programming Interfaces (APIs). As
APIs are increasingly used to connect applications and services, they have
become a significant target for attackers. API pen-testing helps ensure that
these interfaces are secure against potential threats.

Steps in the API Pen-Testing Process

1. Information Gathering (Reconnaissance)

Objective: Understand the API’s structure, endpoints, functionality, and

authentication mechanisms.

Actions:

 Documentation Review: Collect API documentation, such as Swagger

files, Postman collections, or developer manuals, to identify endpoints,
methods, and expected inputs/outputs.
 Publicly Available Information: Search for publicly accessible API
documentation, forums, GitHub repositories, or any other relevant
information that could reveal details about the API.
 DNS and Subdomain Enumeration: Identify API endpoints through DNS
enumeration, subdomain enumeration, and IP address discovery.

2. Authentication and Authorization Testing

Objective: Assess the security of the API's authentication mechanisms and

whether access controls are properly implemented.
Actions:

 Authentication Bypass: Test for vulnerabilities that allow bypassing

authentication (e.g., weak tokens, improper session handling).
 Token Manipulation: Analyze and tamper with tokens (e.g., JWT, OAuth)
to see if they can be altered to gain unauthorized access.
 Role-based Access Control (RBAC) Testing: Ensure that users with
different roles have access only to their designated resources. Attempt
privilege escalation by changing user roles or tokens.

3. Input Validation Testing

Objective: Test how the API handles various types of input to identify injection
vulnerabilities.

Actions:

 SQL Injection: Inject SQL commands in input fields to test if the API is
vulnerable to SQL injection.
 Cross-Site Scripting (XSS): Attempt to inject malicious scripts in the input
to see if the API is vulnerable to XSS.
 Command Injection: Test if the API is susceptible to command injection
by inputting system commands.
 Server-Side Request Forgery (SSRF): Attempt to manipulate the server
into making requests to unintended locations by altering input fields that
handle URLs.

4. Testing for Business Logic Flaws

Objective: Identify flaws in the API’s logic that could be exploited for malicious
purposes.

Actions:

 Workflow Manipulation: Manipulate the sequence of API calls or inputs

to bypass business logic (e.g., skipping payment steps).
 Rate Limiting: Test for rate-limiting issues by sending numerous requests
in a short period. Check if the API is susceptible to denial-of-service (DoS)
attacks.
 IDOR (Insecure Direct Object Reference): Attempt to access resources by
manipulating object identifiers (e.g., accessing other users’ data by
changing user IDs in requests).
5. Endpoint Testing

Objective: Identify vulnerabilities in each API endpoint by performing various

security tests.

Actions:

 Fuzz Testing: Send random or unexpected data to API endpoints to

identify how the API handles invalid inputs.
 Method Testing: Test all HTTP methods (GET, POST, PUT, DELETE, etc.) on
each endpoint to ensure only appropriate methods are allowed.
 Parameter Tampering: Manipulate parameters sent to the API to test for
unexpected behavior or security flaws.

6. Session Management Testing

Objective: Assess how the API handles sessions and the security of session
tokens.

Actions:

 Session Hijacking: Attempt to steal or reuse session tokens to gain

unauthorized access.
 Session Expiration: Test if sessions expire correctly and whether session
tokens are invalidated after logout or a period of inactivity.
 Replay Attacks: Try to reuse valid API requests to see if the API accepts
them again (e.g., replaying a payment request).

7. Error Handling Testing

Objective: Analyze how the API handles errors and whether it leaks sensitive
information.

Actions:

 Error Messages: Trigger errors intentionally to see if detailed error

messages are returned to the client. These messages could reveal
sensitive information (e.g., stack traces, database details).
 Response Codes: Analyze HTTP response codes to ensure that the API
follows security best practices and does not expose information through
incorrect status codes.
8. Security Testing for Sensitive Data Exposure

Objective: Identify if the API leaks sensitive data through its responses or in
transit.

Actions:

 Data in Transit: Use tools like Burp Suite or OWASP ZAP to inspect the
data sent over the network. Ensure that data is encrypted and not
exposed in plaintext.
 Data at Rest: If access is available, inspect databases or storage to ensure
sensitive data is encrypted or adequately protected.
 Response Content: Analyze API responses for exposure of sensitive data
such as PII, credit card information, or authentication credentials.

9. Automated Scanning

Objective: Use automated tools to scan the API for known vulnerabilities.

Actions:

 API Vulnerability Scanners: Use tools like OWASP ZAP, Burp Suite, or
Postman’s security scans to automate the discovery of common
vulnerabilities.
 Continuous Scanning: Implement automated scans in CI/CD pipelines for
continuous monitoring and detection of vulnerabilities as the API evolves.

10. Manual Testing

Objective: Perform manual tests to uncover complex vulnerabilities that

automated tools may miss.

Actions:

 Custom Scripts: Write custom scripts to test specific aspects of the API
that are unique or require more intricate testing.
 Business Logic Analysis: Use manual techniques to identify and exploit
complex business logic flaws.
11. Reporting

Objective: Document findings in a detailed report that includes vulnerabilities,

their impact, and remediation recommendations.

Actions:

 Vulnerability Summary: Provide an overview of the discovered

vulnerabilities, including their risk level and potential impact.
 Proof of Concept: Include detailed steps to reproduce each vulnerability,
often with screenshots or sample API requests/responses.
 Remediation Recommendations: Offer guidance on how to fix or mitigate
each identified vulnerability.
 Executive Summary: Include a high-level summary of the findings for
stakeholders who may not be technical.

Reference

https://medium.com/@pg99285/introduction-to-api-penetration-testing-
b2a0de14c635
https://medium.com/@muhammad22/api-penetration-testing-api-
pentesting-c45d7e8b85cc
https://medium.com/@aakashgupthagwapt/overview-of-api-penetration-
testing-2065f6722f4e
https://medium.com/@miladkeivanfar/quick-guide-api-penetration-testing-
496c2e356a2e