API Security Testing
Using Modern Tools
rama Al-jubeh & sama Al-atawneh
Objectives
Understand what an API is
Learn why API Security matters
Review common API vulnerabilities
Understand different API security
testing techniques
Compare API security testing tools
Perform a live demo using OWASP
ZAP
Learn how to protect APIs
What is an API?
API = Application Programming Interface Uses HTTP (GET, POST, PUT, DELETE)
Connects applications to servers Commonly returns JSON
Modern apps APIs handle
rely heavily on sensitive
APIs data
Why is API APIs are Attackers
Security often publicly target APIs
directly
Important? exposed
Broken
Injection
Authorization
Attacks
(IDOR)
Security
Misconfiguration Excessive
Data Exposure
Common
Broken
API Risks
According to OWASP
Authentication
Application Security Testing Types
SAST DAST
Static Application Security Testing Dynamic Application Security Testing
Works on code before running Works from outside, sends requests &
checks responses
Does not detect runtime issues or
logic flaws Cannot see internal code or logic flaws
Tools: SonarQube, Checkmarx Tools: OWASP ZAP, Burp Suite
Application Security Testing Types
IAST RAST
Interactive Application Security Runtime Application Self-Protection
Testing
Works during app execution in
Works inside app during runtime production
Shows exact line and data path Protects app in real-time
Combines SAST + DAST Not for pre-release testing
Tools: Contrast Security, Seeker Tools: Contrast Protect
API Security Testing Tools
Postman Burp Suite OWASP ZAP
Manual API testing Industry-standard penetration Free & open source
Easy to learn testing tool Automated security
Good for understanding Advanced proxy & interception scanning
requests/responses Powerful scanning engine (Pro Active & passive scanning
Limited automated security version) Good balance between
scanning Steeper learning curve power and usability
What Is ZAP?
A tool for finding vulnerabilities in web apps
Free and Open Source
Community based
Cross platform
Well maintained
Desktop, cmdline, daemon, docker, GitHub
actions
Probably the World's most popular web scanner
What Does ZAP Do?
How Does ZAP Work?
It is an Integrated Hacking Environment
Set of flexible tools
Core plus add-ons
Manual or automated
Powerful scripting options
Simple Usecase
Authenticate
Explore
-Manually
-Spiders
-Import API Definitions
Passive Scanning
Attack - Active Scanning
Report
Demo Scenario
1. Import → OpenAPI Definition 2. Insert Swagger/OpenAPI URL
Sample OpenAPI specification file used for API security testing: URL
[Link]
Demo Scenario
3. Endpoints appear in Sites tree 4. Review Alerts
DEMO
How to Protect APIs
Strong Authentication (JWT / OAuth)
Proper Authorization checks
Input validation
Limit returned data
Secure configuration
Regular security testing
Thank You
Any Questions?