API and Web Service Penetration Testing
An API penetration test examines the REST, GraphQL and SOAP services used by applications and partners for authorisation, authentication and business logic flaws, from an attacker's point of view. Nokta Guard bases this test on the OWASP API Security Top 10 (2023). Broken object level authorisation (BOLA) and excessive data exposure are the top priority areas.
The business logic behind web and mobile apps usually runs in APIs. Because APIs can be called directly, a field hidden in the interface or a check done on the client will not stop an attacker; authorisation must be verified on the server for every request.
We call every endpoint with different user roles and object IDs to verify authorisation one by one.
Control Scope
areas · OWASP API Security Top 10 (2023)
Broken object level authorisation (BOLA)
Whether a user can reach another user's record by changing an ID.
Authentication
Token issuance, expiry, signature validation (e.g. JWT) and password reset flows.
Object property level authorisation
Responses returning more data than needed, and fields that should not be writable being changed.
Resource consumption
Rate limiting, page sizes and abuse of expensive queries.
Function level authorisation
Admin functions callable by unauthorised users.
Sensitive business flows
Automated abuse of bulk actions, coupons or bookings.
SSRF and injection
Server-side request forgery, SQL/NoSQL injection and GraphQL-specific query risks.
Configuration and inventory
Old or undocumented API versions, verbose errors and CORS settings.
We ask for API documentation (OpenAPI/Swagger, a Postman collection or a GraphQL schema) and a test account for each role. Endpoints are inventoried first, then each one is tested manually with different role and object combinations.
Duration depends on the number of endpoints, roles and the complexity of the workflows. If documentation is missing, building the inventory is added to the timeline.
Executive summary. Findings mapped to the OWASP API Security Top 10, with sample requests/responses and CVSS score. Endpoint-level remediation advice. Retest report.
Open banking and payment services, partner integrations, mobile app backends and organisations running microservice architectures.