API PENETRATION TESTING

OVERVIEW

Krypsys provides penetration testing of RESTful, SOAP and GraphQL APIs used by web applications, mobile applications and system-to-system integrations.

API testing is performed directly against the service rather than relying only on behaviour exposed through a user interface. This allows our consultants to assess how endpoints, methods, operations, queries and mutations handle authentication, authorisation, input and access to data.

A particular focus is placed on access control. APIs often expose functions or data that are not visible through the frontend, so we test whether users can manipulate object references, call functions outside their intended role or access information belonging to other users, organisations or tenants.

We also assess whether client-side controls can be bypassed by modifying requests directly, including parameters, HTTP methods, headers, tokens and data submitted to the API.

TYPICAL AREAS COVERED

For RESTful APIs, including services using JSON or XML, testing typically includes:

• Endpoint and method discovery
• Authentication and token handling
• Object-level authorisation
• Function-level authorisation
• Request and parameter manipulation
• Mass assignment
• Excessive data exposure
• Injection vulnerabilities
• File handling
• Rate limiting and resource consumption
• Business logic weaknesses
• Access between different users, roles and tenants

For SOAP and XML-based web services, testing can include:

• WSDL and service discovery
• Authentication and authorisation
• SOAP action and operation access controls
• XML input handling
• XML injection
• XML External Entity processing
• Schema and message validation
• Request manipulation
• Information disclosure
• Business logic weaknesses

For GraphQL APIs, testing can additionally include:

• Schema and introspection exposure
• Query and mutation authorisation
• Field-level access control
• Resolver-level authorisation
• Object reference manipulation
• Aliases and batching
• Query depth and complexity
• Excessive data retrieval
• Resource consumption
• Business logic abuse

Where an API forms part of a wider web or mobile application, it can be included within the same engagement or tested independently where a more focused review is required.

Findings are manually validated and documented with reproducible request and response evidence, together with clear technical guidance for developers and API owners. Retesting can be carried out after remediation.