APIs now carry most of the traffic behind web and mobile applications, and they are often exposed with less scrutiny than the interfaces built on top of them. We test APIs directly, covering authentication and authorisation, input handling, rate limiting and the business logic behind each endpoint, whether the API is public, partner-facing or internal.
API Methodology Summary
Interface Mapping
We will review the full attack surface before continuing onto the security assessment, ensuring that we achieve both depth and scope coverage. This will include dynamically mapping an interface, or may simply involve processing machine readable instructions such as a Swagger or WSDL file.
Application Vulnerability Discovery
We review the interface for the presence of a range of vulnerabilities, including but not limited to those covered by awareness documents such as the OWASP Top 10 API Security Risks.
The following list gives an indication of the types of vulnerability that can be discovered through this type of engagement:
- Business logic issues
- Broken access control
- Broken Object Level Authorization
- Broken Authentication
- Broken Object Property Level Authorization
- Unrestricted Resource Consumption
- Broken Function Level Authorization
- Unrestricted Access to Sensitive Business Flows
- Server-Side Request Forgery
- Security Misconfiguration
- Improper Inventory Management
- Unsafe Consumption of APIs
- Weak account restrictions
- Insecure file handling
Analysis and Exploitation
Where a vulnerability is discovered our testing report will include a full breakdown of the potential for exploitation thereby removing false positives, removing the guess work from grading vulnerability risks, and giving the steps to replicate the vulnerability to ensure that your technical teams fully understand each issue.
Underlying Infrastructure Assessment
Where requested we can include the underlying external infrastructure within an API assessment. Whilst most implementations only expose HTTP(S) to the internet we can review the system to ensure no additional services are exposed as well as ensuring that the cryptographic configuration of Transport Layer Security (TLS) is appropriate for the organisation.
Remediation
We don’t just focus on vulnerability discovery, but we also give significant detail on remediating discovered vulnerabilities and importantly, hardening systems against exploitation.