API Security
Your API is your attack surface. Every endpoint is a door. We test whether any of them are unlocked.
Sherlock Forensics provides API penetration testing covering REST, GraphQL and gRPC endpoints. Full OWASP API Top 10 validation including BOLA, BFLA, broken authentication and injection. OAuth, JWT and API key testing. Over 20 years of certified security experience. Contact 604.229.1994.
APIs now carry more traffic than traditional web pages. They handle authentication, process payments, transfer sensitive data and connect your application to third-party services. A single misconfigured endpoint can expose your entire database. API security testing is not a subset of web application testing. It is its own discipline with its own methodology, its own vulnerability classes and its own tooling.
Methodology
Web application testers follow the user interface. API testers work directly with HTTP requests, reading documentation (or discovering undocumented endpoints) and crafting payloads that the frontend would never send. The most dangerous API vulnerabilities exist in logic that no browser ever invokes. A web app pentest that only tests what the UI exposes misses the majority of the API attack surface.
In web applications, the server often controls what data the user sees through rendered pages. In APIs, the client requests specific resources by ID. If the server does not verify that the requesting user owns that resource, any authenticated user can access any other user's data. This class of vulnerability (BOLA) is the number one item on the OWASP API Security Top 10 and is almost never caught by automated scanners.
Web apps typically use HTML over HTTP. APIs use REST with JSON, GraphQL with its own query language, gRPC with Protocol Buffers, SOAP with XML and sometimes custom binary formats. Each protocol has distinct attack vectors. GraphQL introspection exposes your entire schema. gRPC reflection reveals service definitions. Testing requires protocol-specific tooling and knowledge.
Coverage
Every API security assessment from Sherlock Forensics covers the full OWASP API Security Top 10. These are the vulnerability categories that appear most frequently in real-world API breaches.
| Category | What We Test |
|---|---|
| API1 - BOLA | Object-level authorization on every endpoint. We manipulate resource IDs to verify access controls enforce ownership. |
| API2 - Broken Authentication | Token validation, credential stuffing protection, password reset flows, OAuth implementation and session management. |
| API3 - Object Property Authorization | Mass assignment testing. We send additional properties in requests to check if the server accepts fields users should not control. |
| API4 - Resource Consumption | Rate limiting validation, pagination abuse, file upload size limits and query complexity restrictions. |
| API5 - BFLA | Function-level authorization. We test whether lower-privilege users can invoke admin-only API functions. |
| API6 - Sensitive Business Flows | Abuse of business logic through API automation: bulk purchases, referral fraud, data scraping and workflow manipulation. |
| API7 - SSRF | Server-side request forgery through URL parameters, webhook configurations and file import features. |
| API8 - Security Misconfiguration | CORS policy, HTTP headers, error messages exposing internals, unnecessary HTTP methods and default credentials. |
| API9 - Improper Inventory | Discovery of undocumented endpoints, deprecated API versions still active and shadow APIs that bypass security controls. |
| API10 - Unsafe Consumption | Risks from third-party API integrations: insufficient validation of external data, trust assumptions and supply chain risks. |
Scope
Endpoint enumeration across all HTTP methods. Authentication and authorization testing on every route. Input validation for all parameters including path, query, header and body. Response analysis for data leakage. We test pagination, filtering and sorting parameters for injection and information disclosure. Versioned APIs are tested across all active versions to identify security regressions in older implementations.
Introspection query analysis to map the full schema. Query depth and complexity attacks to test for denial of service. Batching and aliasing abuse to bypass rate limiting. Field-level authorization testing to verify that users cannot query fields they should not access. Mutation authorization testing. Subscription security validation. GraphQL-specific injection vectors that differ from REST attack patterns.
Server reflection analysis to discover service definitions. Protocol Buffer message manipulation to test input validation. TLS configuration and certificate validation. Authentication metadata testing. Stream handling security for both unary and streaming RPCs. gRPC-web proxy configuration review. Deadline and timeout abuse testing.
OAuth 2.0 flow testing across authorization code, client credentials, PKCE and implicit grants. JWT validation including signature verification, algorithm confusion attacks, claim manipulation and token expiry enforcement. API key security including transmission, storage and rotation practices. Bearer token scope validation. We verify that every endpoint enforces authentication and that privilege boundaries hold under manipulation.
Rate limit testing across all endpoints with different authentication contexts. Bypass testing through header manipulation, IP rotation simulation and request parameter variation. Cost analysis for resource-intensive endpoints. Pagination abuse testing. Bulk operation limits. We identify endpoints where absence of rate limiting enables data scraping, credential stuffing or denial of service.
SQL injection through all input vectors including JSON body parameters, path parameters and query strings. NoSQL injection for MongoDB and similar datastores. Command injection through parameters that interact with system processes. LDAP injection, XPath injection and template injection where applicable. We test every parameter that reaches a backend interpreter.
Authorization Flaws
References
The industry standard for API vulnerability classification. Our testing methodology maps directly to the OWASP API Security Top 10 categories.
Guide to Secure Web Services from the National Institute of Standards and Technology. Covers security considerations for web services and APIs.
Cybersecurity and Infrastructure Security Agency guidance on securing APIs and web services in critical infrastructure.
Frequently Asked Questions
Related
Our full penetration testing methodology covering web applications, APIs, infrastructure and mobile platforms.
Multi-tenant security testing for SaaS companies including API security, data isolation and compliance-ready reporting.
Container and cluster security testing including RBAC, network policies, secrets management and pod security standards.
Get Started
Comprehensive API security assessment covering REST, GraphQL and gRPC. OWASP API Top 10 validated.
Tell us about your API architecture, authentication mechanisms, endpoint count and compliance requirements. We will scope an assessment that covers your specific attack surface.
Call 604.229.1994