API Security Testing Guide by The XSS Rat

Clarify authentication versus authorization and demonstrate how tokens, API keys, OAuth, JWT, and basic auth secure APIs for mobile and web apps, with emphasis on security zones and documentation.

Compare soap and rest APIs, focusing on xml vs json messaging and stateless versus stateful design. Explore security implications, http methods, headers, authentication, and legacy versus modern usage.

Explore the difference between API authentication and authorization, including basic authentication, its base64 encoding, vulnerabilities, and why API keys expose credentials and lack user-specific context.

Evaluate api key authentication in a flask app by enforcing an x-api-key header before every request, returning 401 on mismatch, and illustrating hard-coded versus database-stored keys.

Implement basic authentication in a Flask API with flask_httpauth, two users and a verify_password method that protects the /api endpoint and handles 401 errors with the base64-encoded authorization header.

Learn to implement jwt authentication with a secret key, parse bearer tokens from the authorization header, and enforce a token required decorator to handle missing, expired, or invalid tokens.

Follow the basic OAuth 2.0 authorization code flow in Flask, configuring client id and secret, redirect URI, and the authorization and token endpoints, while simulating GitHub as the provider.

Explore monolith and microservice architectures, gateway security, serverless, GraphQL, and API composition, then master rate limiting, caching, container orchestration, and logging for resilient APIs.

Explore the API top ten vulnerabilities, focusing on broken object level authorization and broken user authentication, with practical testing using JWT tokens, OpenAPI, Swagger, and Postman.

Master rate limiting on API endpoints to prevent denial of service, authentication attacks, and credential stuffing, and guard against broken function level authorization and shadow properties.

Explore api injections across sql, ldap, and os command types, emphasizing input sanitization at the front end and api, validating requests, and guarding csv imports, batch jobs, and file handling.

Maintain a comprehensive inventory of all production APIs and versions, retire unused endpoints, and document access controls, authentication, rate limiting, and policy triggers with OpenAPI documentation and API gateways.

Explore insufficient logging and monitoring in the OWASP API top ten, including failed login attempts and errors, and the need for monitoring and response actions, with limited bug bounty usefulness.

Explore how a login page without captcha enables bots to attempt logins, illustrating broken authentication and the need for rate limiting and defenses against credential stuffing.

Examine excessive information disclosure in API security: an API returning credit card number, user, and validity date exposes sensitive data to potential man-in-the-middle attacks, risking interception.

Examine a login system with no rate limiting, enabling attackers to keep trying credentials and build bots, especially without captcha, and emphasize rate limiting for important resources.

Explore broken function level authorization that exposes admin endpoints in version three API resources, and how improper requests or missing parameters can produce bad requests rather than 403 errors.

Demystify mass assignment by showing how exposing a user type parameter in a post to the user endpoint can change a user to admin.

Explore security misconfiguration by examining a debugging setting left on true, which could permit remote debugging. Learn to prevent this risk by always setting debug to false.

Demonstrates a basic SQL injection on a login page to bypass authentication and highlights how injections such as cross-site scripting, LDAP, CSRF, and JSON injections expand the attack surface.

Learn the basics of asset management for API security testing by cataloging all systems, their ports, and version numbers. Avoid having no repository or unmanaged files.

Emphasize sufficient logging and monitoring for APIs to prevent unmonitored logs and attacker activity, and implement segregated logs with active monitoring to detect intrusions.

Explore how to emulate SQL injection in an API using a Flask login system, trigger SQL errors, and expose an admin username found in source code via server-side template injection.

Explore api broken access control by replacing http method to reveal vulnerabilities in the books endpoint, distinguishing get and post behavior and experimenting with endpoints like books/all and resource/books.

Explore chaining postman with burp suite to proxy and scan a rest API, configure dynamic ports and globals, and identify vulnerabilities like unintended data exposure and transfer processing issues.

Protect your apis with a lightweight, free firewall and learn to deploy it via Docker, configure with environment variables, and validate requests using api specifications.

Explore Postman as a hands-on API testing tool, building collections and workspaces, configuring global and environment variables, and executing get, post, put, delete requests against the json placeholder API.

Import API descriptions into Postman from files, links, raw text, or git, generating a collection. Explore open API and GraphQL support, then publish to a private API network.

Learn how to test api requests with Postman, using pre-request scripts, tests, and the console to validate json responses, handle global variables, and interpret run results.