api-security-testing

API Security Testing

Overview

API security testing is an important part of ensuring the security of API interfaces. This skill provides methods, tools, and best practices for API security testing.

Testing Scope

1. Authentication and Authorization

Test items:

• Token validity verification
• Token expiration handling
• Permission control
• Role permission verification

2. Input Validation

Test items:

• Parameter type validation
• Data length limits
• Special character handling
• SQL injection protection
• XSS protection

3. Business Logic

Test items:

• Workflow validation
• State transition
• Concurrency control
• Business rules

4. Error Handling

Test items:

• Error information leakage
• Stack trace
• Sensitive information exposure

Testing Methods

1. API Discovery

Identify API endpoints:

# 使用目录扫描
gobuster dir -u https://target.com -w api-wordlist.txt

# 使用Burp Suite被动扫描
# 浏览应用，观察API调用

# 分析JavaScript文件
# 查找API端点定义

2. Authentication Testing

Token testing:

# 测试无效Token
GET /api/user
Authorization: Bearer invalid_token

# 测试过期Token
GET /api/user
Authorization: Bearer expired_token

# 测试无Token
GET /api/user

JWT testing:

# 使用jwt_tool
python jwt_tool.py <JWT_TOKEN>

# 测试算法混淆
python jwt_tool.py <JWT_TOKEN> -X a

# 测试密钥暴力破解
python jwt_tool.py <JWT_TOKEN> -C -d wordlist.txt

3. Authorization Testing

Horizontal permissions:

# 用户A访问用户B的资源
GET /api/user/123
Authorization: Bearer user_a_token

# 应该返回403

Vertical permissions:

# 普通用户访问管理员接口
GET /api/admin/users
Authorization: Bearer user_token

# 应该返回403

4. Input Validation Testing

SQL injection:

POST /api/search
{
  "query": "test' OR '1'='1"
}

Command injection:

POST /api/execute
{
  "command": "ping; id"
}

XXE：

POST /api/parse
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>

5. Rate Limit Testing

Test rate limits:

import requests

for i in range(1000):
    response = requests.get('https://target.com/api/endpoint')
    print(f"Request {i}: {response.status_code}")

Tool Usage

Postman

Create test collection:

1. Import API documentation
2. Set up authentication
3. Create test cases
4. Run automated tests

Burp Suite

API scanning:

1. Configure API endpoints
2. Set up authentication
3. Run active scanning
4. Analyze results

OWASP ZAP

# API扫描
zap-cli quick-scan --self-contained \
  --start-options '-config api.disablekey=true' \
  http://target.com/api

REST-Attacker

# 扫描OpenAPI规范
rest-attacker scan openapi.yaml

Common Vulnerabilities

1. Authentication Bypass

Token validation flaws:

• Weak token generation
• Predictable tokens
• Tokens do not verify signatures

2. Privilege Escalation

IDOR：

• Direct object reference
• Unverified resource ownership

3. Information Leakage

Error information:

• Detailed error information
• Stack trace
• Sensitive data

4. Injection Vulnerabilities

Common injections:

• SQL injection
• NoSQL injection
• Command injection
• XXE

5. Business Logic

Logic flaws:

• Price manipulation
• Quantity limit bypass
• State modification

Testing Checklist

Authentication Testing

• Token validity verification
• Token expiration handling
• Weak token detection
• Token replay attack

Authorization Testing

• Horizontal permission testing
• Vertical permission testing
• Role permission verification
• Resource access control

Input Validation

• SQL injection testing
• XSS testing
• Command injection testing
• XXE testing
• Parameter pollution

Business Logic

• Workflow validation
• State transitions
• Concurrency control
• Business rules

Error handling

• Error message leakage
• Stack traces
• Sensitive information exposure

Protective measures

Recommended solutions

1. Authentication

   • Use strong tokens
   • Implement token refresh
   • Verify token signature

2. Authorization

   • Role-based access control
   • Resource ownership verification
   • Principle of least privilege

3. Input validation

   • Parameter type validation
   • Data length limits
   • Whitelist validation

4. Error handling

   • Unified error responses
   • Do not leak detailed information
   • Log errors

5. Rate limiting

   • Implement API rate limiting
   • Prevent brute-force attacks
   • Monitor abnormal requests

Notes

• Perform only in authorized test environments
• Avoid impacting the API
• Note differences between API versions
• Pay attention to request frequency during testing