Offensive Security
API Penetration Testing
Authorisation-focused testing of REST, GraphQL and internal APIs, guided by the OWASP API Security Top 10.
Overview
APIs expose the application's logic directly, without a user interface to constrain how they are called. That makes object-level and function-level authorisation the dominant risk: whether one customer can read another customer's record simply by changing an identifier, and whether administrative operations are genuinely restricted.
We test every documented operation and hunt for the undocumented ones, using multiple accounts and roles to prove where authorisation is missing. Testing covers authentication and token handling, mass assignment, resource consumption, and inconsistencies between API versions.
Methodology
How the engagement runs from start to finish.
- Scoping, authorisation and credential provisioning
- Specification review and endpoint discovery
- Cross-account and cross-role authorisation matrix testing
- Object-level and function-level authorisation checks
- Input validation, mass assignment and injection testing
- Rate limiting and resource consumption testing
- Exploitation, evidence capture and CVSS scoring
- Reporting, debrief and retest
Related
Often scoped alongside this
Web Application Penetration Testing
Manual, authenticated testing of your web application against the way real attackers approach it.
Learn more Offensive Security
Network Penetration Testing
External and internal network testing that establishes how far an attacker could actually get.
Learn more Offensive Security
Cloud Penetration Testing
Configuration and identity review of AWS, Azure and GCP environments, combined with hands-on attack-path testing.
Learn more
Ready to find the weaknesses first?
Tell us what you are building or what you need tested. We will come back with a scope, a timeline and a clear price, with no obligation.