API Penetration Testing

API Penetration Testing – service by Suvendu Dash

APIs carry the data and business logic behind your web and mobile apps, which makes them a favourite target. API penetration testing checks your REST and GraphQL endpoints the way an attacker would, with a focus on authorisation and data exposure, the two areas where most real API breaches happen.

I have tested APIs behind large fintech products, and I report API vulnerabilities through HackerOne, Bugcrowd and YesWeHack.

What I test

  • Broken object level authorisation (BOLA/IDOR): can one user read or change another user’s objects?
  • Broken function level authorisation: can a normal user call admin or internal endpoints?
  • Authentication: token handling, JWT weaknesses, API keys, OAuth flows and password reset.
  • Excessive data exposure and mass assignment: responses that leak fields, and requests that set fields they should not.
  • Injection and SSRF through API parameters and webhooks.
  • Rate limiting and resource abuse: brute force, enumeration and expensive queries.
  • GraphQL-specific issues: introspection, batching and nested query abuse.

How I work

Testing is based on the OWASP API Security Top 10.

  1. Scoping: you share API documentation (OpenAPI/Swagger, Postman collection or GraphQL schema) and test accounts for each role.
  2. Mapping: I build a full inventory of endpoints, including undocumented ones found through the apps that use the API.
  3. Manual testing: every endpoint is tested across roles for authorisation, input handling and logic flaws.
  4. Validation: each finding is confirmed with a working request, so your team can reproduce it in minutes.
  5. Reporting and retest.

What you get

  • A prioritised report with severity, impact and the exact requests needed to reproduce each issue.
  • Fix guidance that fits your framework and architecture.
  • A retest of fixed issues.

Related services

APIs are usually tested alongside the apps that call them: see web application and mobile app penetration testing.

Get started

Tell me what you want tested, how large it is and when you need it, and we can agree a scope. Contact me to discuss your API.