Offensive security assessments
Rest API
We validate this area during scoped assessments, documenting impact and remediation guidance.
Why it matters
REST remains the default API style for mobile, SPA, and partner integrations. Misconfigured auth, missing rate limits, and verbose errors on REST endpoints are among the most common sources of breaches.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Enumerate routes from OpenAPI specs, traffic captures, and application behavior.
- Exercise each endpoint across roles: anonymous, user, admin, service account.
- Validate input handling on query params, headers, and JSON bodies.
- Test JWT/OAuth token lifecycle, CORS policy, and error handling consistency.
What we look for
- Undocumented admin or debug routes still reachable in production.
- Horizontal and vertical privilege escalation on resource IDs.
- Sensitive data in error responses and excessive fields in GET payloads.
- Missing HTTPS, weak CORS, and absent throttling on authentication endpoints.
Engagement checklist
Items we validate during scoping and execution for this topic.
Information gathering
- Identify API purpose, business logic, and versioning strategy.
- Enumerate endpoints, methods, and parameters from specs and traffic.
- Discover hidden routes and review available documentation.
Authentication
- Test API keys, OAuth, JWT, and basic authentication mechanisms.
- Verify secure client-side token storage patterns.
- Assess MFA enforcement where configured.
Authorization
- Validate RBAC and object-level access on every resource type.
- Test horizontal privilege escalation across user accounts.
- Confirm admin-only functions are unreachable to standard users.
Input and data
- Test injection, validation, and output encoding on all inputs.
- Review file upload endpoints for type and content checks.
- Confirm PII and secrets are not returned in API responses.
Operations
- Validate rate limiting and anti-automation on sensitive endpoints.
- Test JWT signature validation and OAuth token rotation.
- Review webhook and callback authentication and replay resistance.
Related topics
| Topic | Summary |
|---|---|
| GraphQL | The Schema defines the capabilities of the API and represents the contract between the client and the server. It defines the types available in the API and how they can be queried and mutated. |
| Mass Assignment (API3:2023) | Mass Assignment happens when an API binds client-supplied JSON directly to an internal object or database model. If the binding is not filtered by an allowlist, an attacker can set fields they were never meant to control, such as role, isAdmin, verified, balance, accountid, or p… |