Short answer: API penetration testing is a security assessment that simulates real attacks against REST, GraphQL, and SOAP APIs to find flaws like broken object level authorisation, broken authentication, and excessive data exposure. It combines manual testing with tools such as Burp Suite, Postman, and ffuf, mapped to the OWASP API Security Top 10.
Modern applications are built on APIs. A single mobile app or single-page website can talk to dozens of backend endpoints, and every one of them is an entry point. Attackers know this, which is why APIs are now the most attacked surface on the internet. In this guide we explain how professional penetration testing is applied to APIs, the methodology we follow at Cyber Defence, the OWASP API Security Top 10, and the tools that get the job done.
Why APIs Are the Weakest Security Surface
Traditional web applications render HTML on the server, so a lot of logic and validation happens in one place. APIs are different. They expose raw business logic and data directly to clients, and much of the "front end" logic lives in JavaScript or a mobile app that an attacker fully controls. This creates a dangerous gap.
- APIs expose object and data structures directly. Guessing or tampering with an ID often returns another user's data.
- Automated scanners miss business logic. A scanner cannot know that user A should never read user B's invoice.
- Documentation leaks attack surface. Swagger/OpenAPI files, if exposed, hand attackers a full map of endpoints and parameters.
- APIs are often built fast. Rate limiting, authorisation checks, and input validation are frequently skipped under deadline pressure.
REST vs GraphQL vs SOAP APIs
The type of API changes how you test it. Understanding the architecture is the first step of any API pentest.
REST APIs
REST is the most common style. It uses HTTP verbs (GET, POST, PUT, PATCH, DELETE) and resource-based URLs like /api/v1/users/1023. The predictable structure makes REST easy to fuzz and easy to attack with authorisation flaws such as changing the user ID in the path.
GraphQL APIs
GraphQL exposes a single endpoint (often /graphql) and lets the client request exactly the fields it wants. This flexibility introduces unique risks: introspection queries can dump the entire schema, deeply nested queries can cause denial of service, and field-level authorisation is easy to get wrong. Testers use introspection and query batching to probe these issues.
SOAP APIs
SOAP is older and XML-based. It is still common in banking and enterprise systems. Testing focuses on XML injection, XXE (XML external entity), WSDL enumeration, and weak WS-Security configurations.
OWASP API Security Top 10 (2023 Edition)
Every serious API penetration test is benchmarked against the OWASP API Security Top 10. This is the industry standard list of the most critical API risks.
| Rank | Risk | What it means |
|---|---|---|
| API1 | Broken Object Level Authorization (BOLA) | Changing an object ID lets you access data you should not see. The #1 API vulnerability. |
| API2 | Broken Authentication | Weak tokens, no expiry, guessable JWTs, or endpoints that skip auth entirely. |
| API3 | Broken Object Property Level Authorization | Excessive data exposure or mass assignment: the API returns or accepts fields it should not. |
| API4 | Unrestricted Resource Consumption | No rate limiting or quotas, enabling brute force, scraping, and denial of service. |
| API5 | Broken Function Level Authorization | A normal user can call admin-only functions by guessing the endpoint. |
| API6 | Unrestricted Access to Business Flows | Automation abuses a flow (e.g. buying all stock) that was meant for humans. |
| API7 | Server Side Request Forgery (SSRF) | The API fetches a user-supplied URL, letting attackers reach internal systems. |
| API8 | Security Misconfiguration | Default settings, verbose errors, missing headers, open CORS. |
| API9 | Improper Inventory Management | Forgotten old versions (/v1) and undocumented shadow APIs still live in production. |
| API10 | Unsafe Consumption of APIs | Blindly trusting data from third-party APIs your app consumes. |
Broken Object Level Authorization (BOLA) explained
BOLA is by far the most common and most damaging API flaw. Imagine an endpoint GET /api/orders/5001. If the server returns the order without checking that it belongs to the logged-in user, an attacker simply increments the number to 5002, 5003 and harvests every customer's order. Testing for BOLA is manual work: you create two accounts and try to access account A's objects while authenticated as account B.
Excessive data exposure and rate limiting
APIs often return full database objects and rely on the front end to hide sensitive fields. A tester inspects the raw JSON response and frequently finds password hashes, internal flags, or other users' PII. Similarly, missing rate limiting lets attackers brute-force OTPs, login endpoints, and coupon codes. We always test how many requests an endpoint accepts before throttling.
API Penetration Testing Methodology
At Cyber Defence we follow a structured, repeatable process aligned with our VAPT process and methodology.
- Discovery and enumeration: Collect API documentation, Swagger/OpenAPI files, capture live traffic from the app, and map every endpoint, parameter, and authentication scheme.
- Authentication and session testing: Analyse JWTs, API keys, and OAuth flows. Check token expiry, signature validation, and whether tokens can be forged or replayed.
- Authorization testing: The core of API testing. Systematically test BOLA, function-level authorisation, and property-level access using multiple accounts and roles.
- Input validation and injection: Test for SQL/NoSQL injection, XXE, SSRF, and command injection across every parameter.
- Business logic testing: Abuse legitimate flows, race conditions, and negative values (e.g. quantity of -1 to gain credit).
- Rate limiting and resource abuse: Confirm throttling exists on sensitive endpoints.
- Reporting and retest: Deliver a prioritised report with proof-of-concept and remediation, followed by a free retest.
Top API Penetration Testing Tools
| Tool | Purpose |
|---|---|
| Burp Suite | The core proxy for intercepting, modifying, and replaying API requests; Repeater and Intruder drive most manual testing. |
| Postman | Building, organising, and replaying API requests, managing tokens, and running collection-based tests. |
| ffuf / wfuzz | Fast fuzzing to discover hidden endpoints, parameters, and directories. |
| Nuclei | Template-based scanning for known API misconfigurations and CVEs. |
| Kiterunner | Content discovery built specifically for API routes and Swagger patterns. |
| GraphQL tools (InQL, GraphQL Voyager) | Schema introspection and query abuse for GraphQL endpoints. |
| jwt_tool | Analysing and attacking JSON Web Tokens. |
Remember: tools speed up discovery, but authorisation and business-logic flaws require an experienced human. That manual layer is what separates a real API pentest from an automated scan. For a wider toolkit see our VAPT tools list.
Authentication and Token Attacks in Detail
Authentication is where many APIs fall apart, so it deserves special attention. Most modern APIs use JSON Web Tokens (JWTs) or OAuth 2.0 bearer tokens. A JWT is made of three parts, a header, a payload, and a signature, and each part is a common source of weakness. During testing we check several things systematically.
- Algorithm confusion: Some servers accept a token signed with the none algorithm, or can be tricked into verifying an RS256 token as HS256 using the public key as the secret. Both let an attacker forge tokens.
- Weak signing secrets: If the HMAC secret is short or guessable, it can be brute-forced offline with tools like jwt_tool or hashcat, after which any token can be minted.
- Missing expiry and revocation: Tokens that never expire, or that stay valid after logout, let a stolen token be reused indefinitely.
- Claims tampering: Changing a claim such as role: user to role: admin and seeing whether the server trusts it without re-verification.
API keys deserve the same scrutiny. They are frequently leaked in mobile app bundles, client-side JavaScript, and public code repositories. Part of a thorough API pentest is searching for these exposed secrets, because a single leaked key can grant complete access.
Common API Vulnerabilities We Find in Real Assessments
Beyond the OWASP categories, certain patterns show up constantly in Indian startups, SaaS products, and fintech APIs we assess. Awareness of these helps developers fix issues before testing even begins.
- ID enumeration in mobile app backends: Sequential numeric IDs make BOLA trivial. Switching to unguessable UUIDs plus a server-side ownership check is the fix.
- Mass assignment on user profiles: An update endpoint that accepts a full JSON object may allow an attacker to add fields like isAdmin or walletBalance that the UI never exposes.
- Verbose error messages: Stack traces and database errors returned to the client leak framework versions, table names, and query structure.
- Missing rate limits on OTP and login: A serious problem for fintech and e-commerce, enabling account takeover through brute force.
- CORS misconfiguration: A wildcard or reflected origin combined with credentials can let a malicious website read authenticated API responses.
Fixing these is rarely difficult; the challenge is finding them, which requires the disciplined, multi-account manual testing described above rather than a quick automated scan.
API Penetration Testing with Cyber Defence
Cyber Defence is an ISO-certified, GeM-registered VAPT provider founded by Amit Kumar (CEH, CRTA). We deliver manual plus tool-assisted API testing mapped to the OWASP API Security Top 10, with a clear report, remediation guidance, a free retest, and a certificate on completion. API and mobile penetration testing starts from just Rs 30,000, web application testing from Rs 25,000, and network testing from Rs 20,000. We serve clients across India, including VAPT services in Haryana and VAPT services in Delhi. If you want to build these skills yourself, explore our hands-on VAPT training.
FAQ
What is API penetration testing?
API penetration testing is a manual and automated security assessment that attacks REST, GraphQL, and SOAP APIs to uncover vulnerabilities such as broken object level authorisation, broken authentication, injection, and excessive data exposure before real attackers exploit them.
What is the OWASP API Security Top 10?
It is the industry-standard list of the ten most critical API security risks, led by Broken Object Level Authorization (BOLA). Every professional API pentest is benchmarked against it.
How is API testing different from web application testing?
Web app testing focuses on rendered pages and browser behaviour, while API testing targets raw endpoints, tokens, and business logic. APIs expose data structures directly, so authorisation flaws like BOLA are far more common and require multi-account manual testing.
Which tools are used for API penetration testing?
Common tools include Burp Suite, Postman, ffuf, Nuclei, Kiterunner, jwt_tool, and GraphQL-specific tools like InQL. Tools assist discovery, but authorisation and logic flaws still need a skilled tester.
How much does API penetration testing cost in India?
At Cyber Defence, API penetration testing starts from Rs 30,000 depending on the number of endpoints and complexity, and includes a detailed report, remediation support, a free retest, and a certificate.
Do you provide a certificate after testing?
Yes. On completion we provide a VAPT certificate confirming the assessment, which is useful for clients, audits, and compliance requirements.
Ready to secure your APIs? Talk to Cyber Defence today for an OWASP-aligned API penetration test with a free retest and certificate. Call or WhatsApp +91-75175-72000.