Web Application Penetration Testing
Manual testing of web applications and the APIs behind them: authentication, authorization and tenancy, business logic, and injection, with every finding verified by hand.
Service 03
API & web services penetration testing
APIs carry the data and the business logic, usually with less scrutiny than the interface in front of them. We test them directly, the way an attacker who skips your front end entirely would.
Overview
The problem we are solving
A web interface hides what it does not want users to see. An API answers whoever asks the right question. The most common serious findings in API testing are not exotic: one user reading another user's records by changing an ID, a regular account calling an admin function, or a request that sets fields the client was never meant to touch.
We test public, partner, internal, and mobile backend APIs (the API itself, not the mobile app), along with legacy SOAP and XML web services that often predate modern access control. Testing works from documentation where it exists and from observed traffic where it does not, including the undocumented and deprecated endpoints that are still answering.
Findings map to the OWASP API Security Top 10 and the Web Security Testing Guide, and every one is confirmed by hand before it reaches the report.
Coverage
What we test
Scope is agreed up front; these are the areas an engagement typically covers.
- Object-level authorization
- Broken object-level authorization (BOLA/IDOR) across every resource and identifier, including nested and indirect references.
- Function-level authorization
- Administrative and privileged operations reachable by lower-privilege roles, and HTTP method and versioning tricks that bypass checks.
- Authentication & tokens
- API keys, OAuth flows, JWT validation and signing, token scope and lifetime, and service-to-service credentials.
- Mass assignment & data exposure
- Writable fields that should not be, and responses that return more data than the client ever displays.
- GraphQL, SOAP & gRPC specifics
- Introspection, query depth and batching abuse, WSDL-driven attacks, XML injection and XXE, and protocol-specific authorization gaps.
- Rate, resource & business flow abuse
- Missing rate limits, expensive operations, enumeration, and sensitive business flows that can be automated at scale.
Methodology
How the engagement runs
-
01
Scoping & access
Agree endpoints, environments, roles, and test credentials. Specifications (OpenAPI, GraphQL schema, WSDL, protobuf) are collected where available.
-
02
Discovery & mapping
Building a complete inventory of endpoints, operations, parameters, and roles from documentation and observed traffic, including undocumented routes.
-
03
Authorization matrix testing
Systematically testing each operation as each role and tenant, which is where the majority of serious API findings are found.
-
04
Input & logic testing
Injection, deserialization, mass assignment, and business flow abuse, with automated coverage and manual analysis combined.
-
05
Reporting
Ranked findings with request and response evidence, reproduction steps, and remediation guidance for your framework.
-
06
Debrief & validation handoff
A live walkthrough with the engineers who own the services, with validation steps for every finding. Retesting is available if you would rather we confirm the fixes.
Deliverables
What you receive
- Full technical report with ranked findings, evidence, and reproduction steps
- Findings mapped to the OWASP API Security Top 10
- Endpoint and authorization coverage summary
- Remediation guidance specific to your framework and gateway
- Validation steps for every finding, so your team can confirm and close out each fix on its own
- Live debrief with engineering and leadership
Aligned to
- OWASP API Security Top 10
- OWASP Web Security Testing Guide
- OWASP Application Security Verification Standard
Questions
Frequently asked
We don't have API documentation. Is that a problem?
No. Documentation speeds things up, but we can map an API from traffic generated by your web front end or a test client. Undocumented APIs are often where the most interesting findings are.
Can you test the API behind our mobile app?
Yes, the backend API itself is in scope. We do not test the mobile application binary or on-device behavior.
Should this be scoped with our web application test?
Often, yes. The APIs a web application depends on are covered in a web application test by default. Standalone, partner, or internal APIs are best scoped here so they get dedicated attention.
Related
Often scoped together
Penetration Testing
Manual, objective-driven testing of web applications, APIs, and networks (internal, external, wireless, and physical), built on hands-on consulting experience since 2018, not a scanner with a report template.
Get started
Ready to scope api & web services?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 sales@infocus-security.com