API Security Testing Checklist
Uploaded by
LEO RCAPI Security Testing Checklist
Uploaded by
LEO RCCommon questions
Powered by AIChanging the Content-Type to application/xml affects API security testing by potentially exposing the application to XML-specific vulnerabilities, such as XML External Entity (XXE) attacks. Some APIs might not handle XML payloads securely, leading to the exposure of sensitive data or server-side request forgery, if the application processes and parses the XML inputs without proper validation .
Numeric IDs can be more vulnerable than GUIDs/UUIDs in API security because they are more predictable and easier to guess. Sequential or simple numeric IDs can allow attackers to iterate over them to discover and exploit resources or user data, known as an 'IDOR' (Insecure Direct Object Reference) vulnerability, whereas GUIDs/UUIDs are harder to guess due to their complexity and randomness .
API endpoint testing differs between mobile and web applications, as mobile apps might use different authentication, data handling, or additional endpoints that are not exposed or utilized in web applications. Testers must thus tailor their security tests to account for these differences to effectively identify security vulnerabilities unique to each platform .
Using Google Dorks in API security testing can detect potential vulnerabilities such as exposed configuration files, debug logs, or documentation files like api.yaml, application.wadl, or metadata files that should not be publicly accessible. Google Dorks can find forgotten, misconfigured, or publicly indexed endpoints, thereby identifying potential entry points for further exploitation .
Common methods to test API security vulnerabilities using parameter manipulation include HTTP Parameter Pollution, where multiple parameters with the same name but different values are sent, such as /api/profile?user_id=legit&user_id=victim, and JSON Parameter Pollution, where JSON objects include duplicate keys with different values, like {"user_id":legit,"user_id":victim}. These techniques can exploit APIs that handle parameters incorrectly .
Leveraging non-production environments in API security testing is beneficial because these environments are typically less secure. They may have relaxed security measures such as weaker authentication and authorization controls or insufficient rate limiting and input validation. This allows testers to attempt bypasses and identify vulnerabilities that might not be apparent in a secure production environment .
The use of wildcard characters in API endpoints can be a security risk because it might allow attackers to access unintended resources or bypass restrictions meant to limit access to specific IDs. For example, replacing an ID with a wildcard like * or % in an endpoint such as /api/users/* could inadvertently expose all user data if the API does not properly validate and restrict access .
Testing old versions of APKs and IPAs can expand the attack surface in API security testing because older versions may contain vulnerabilities that have since been patched. These versions might have outdated security mechanisms or exposed endpoints that current versions no longer support, providing additional vectors for an attacker to exploit .
Testing different data types in JSON payloads is important for API security because the system's handling of unexpected or malicious data types can reveal vulnerabilities. For example, sending data types like booleans or complex nested structures instead of expected strings can cause parsing errors, unexpected behavior, or expose applications to injection attacks if proper validation isn't implemented .
Verb tampering is an API security test technique where the HTTP method (verb) used in a request is altered to test for unintended access or functionality. For example, changing a GET request like GET /api/trips/1 to a POST request may expose unintended behaviors or invoke modifications unintended for the original request, revealing insecure method handling .