API Security Testing

This roadmap teaches you to assess the security of REST and GraphQL APIs in authorised engagements. You should already understand HTTP, JSON and basic web security. Practise on your own APIs or on legal training platforms.

• Confirm HTTP and JSON basics
• Prepare an API client (Postman or Burp Suite)
• Plan a weekly study rhythm

• CyberA4U Academy — courses

APIs come in several styles — REST, GraphQL, gRPC and webhooks — with different ways of naming resources, handling errors and versioning. Knowing the style tells you where security controls should sit.

• Compare REST, GraphQL and gRPC
• Identify resources, methods and versions in an API
• Locate where authentication and authorization are enforced

الأدوات والتقنيات: API

APIs authenticate callers with API keys, session cookies, OAuth 2.0 access tokens or JWTs. Each has typical weaknesses, from keys leaked in front-end code to tokens that never expire.

• Explain API keys, OAuth 2.0 flows and bearer tokens
• Check where credentials are stored and sent
• Test token expiry and revocation

الأدوات والتقنيات: API

• OAuth 2.0 (oauth.net)
• OWASP REST Security Cheat Sheet

BOLA is the top API risk: the API returns or changes an object without checking that the caller owns it. Testing uses two accounts and swaps object identifiers between them.

• Explain why object IDs alone are not access control
• Test object access with two accounts
• Recommend per-object authorization checks on the server

الأدوات والتقنيات: API

• OWASP API1:2023 Broken Object Level Authorization

BFLA means a normal user can call functions meant for another role, such as admin endpoints. It often hides in endpoints the UI never shows.

• Find administrative or privileged endpoints
• Test them with low-privilege accounts
• Recommend role checks enforced centrally

الأدوات والتقنيات: API

• OWASP API5:2023 Broken Function Level Authorization

Mass assignment happens when an API copies all client-supplied fields into an object, letting users set fields such as role or balance that they should not control.

• Compare the fields an API returns with the fields it accepts
• Identify sensitive properties
• Recommend explicit allow-lists of writable fields

الأدوات والتقنيات: API

• OWASP API3:2023 Broken Object Property Level Authorization

Without limits, APIs can be abused for brute force, scraping or cost exhaustion. Testing checks whether limits exist, where they are enforced and whether they apply per user, per IP and per endpoint.

• Identify endpoints that need rate limits (login, OTP, search, exports)
• Check how limits are keyed and enforced
• Recommend limits, quotas and pagination caps

الأدوات والتقنيات: API

• OWASP API4:2023 Unrestricted Resource Consumption

GraphQL exposes one endpoint with a flexible query language. Common issues include enabled introspection in production, missing field-level authorization and expensive nested queries.

• Explain queries, mutations and introspection
• Check authorization on individual fields and resolvers
• Recommend depth and cost limits

الأدوات والتقنيات: API

• PortSwigger — GraphQL API vulnerabilities
• OWASP GraphQL Cheat Sheet

JSON Web Tokens carry claims signed by the server. Weaknesses come from accepting unsigned tokens, weak secrets, algorithm confusion or not validating expiry and audience.

• Decode a JWT and explain header, payload and signature
• Check signature, algorithm, expiry and audience validation
• Recommend secure JWT library configuration

الأدوات والتقنيات: API

• PortSwigger — JWT attacks

APIs that fetch URLs, import files or process documents can be pushed into reaching internal systems (SSRF) or handling dangerous content.

• Identify API features that fetch remote resources
• Review file import and export features
• Recommend URL allow-lists and isolated processing

الأدوات والتقنيات: API

• OWASP API7:2023 Server Side Request Forgery

You cannot secure APIs you do not know about. Old versions, test endpoints and undocumented routes are frequent sources of findings.

• Use OpenAPI/Swagger files and front-end code to list endpoints
• Identify old or undocumented API versions
• Recommend an API inventory process

الأدوات والتقنيات: API

• OWASP API9:2023 Improper Inventory Management
• OpenAPI Specification

Scripts make API testing repeatable: replaying requests with different tokens, checking many objects for access control and turning findings into regression tests.

• Send authenticated API requests with Python
• Compare responses across user roles automatically
• Turn a finding into a repeatable test

الأدوات والتقنيات: API

• Python Requests documentation

API findings must be explained with realistic impact: which data is exposed, to whom and at what scale. Clear request/response evidence helps developers reproduce and fix them.

• Write findings with request and response evidence
• Rate severity based on data and scale
• Map findings to the OWASP API Top 10

الأدوات والتقنيات: API

Many API issues are design decisions. Secure defaults — deny by default, central authorization, strict schemas and good logging — prevent whole classes of findings.

• Apply deny-by-default authorization
• Validate requests against a schema
• Log security-relevant API events

الأدوات والتقنيات: API

• OWASP API Security Top 10

Check your progress. You should be able to map an API, test its authentication and authorization, and report findings against the OWASP API Top 10.

• Explain each OWASP API Top 10 risk
• Test a training API end to end
• Identify your two weakest areas

• CyberA4U CTF Arena — practice challenges

You have completed the API Security Testing roadmap. Keep practising on legal labs, help developers build secure APIs, and test only with written authorisation.

• Keep a portfolio of API lab write-ups
• Learn one API gateway's security features
• Follow new API security research

• CyberA4U CTF Arena — practice challenges