conducting-api-security-testing

name	conducting-api-security-testing
description	Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Use when working with conducting api security testing.
domain	cybersecurity
tags	["API-security","OWASP-API-Top10","REST","GraphQL","authorization-testing"]
subdomain	penetration-testing
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"]

Conducting Api Security Testing

Overview

Cybersecurity skill for conducting api security testing. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "conducting api security testing"

• "Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabil"

• Testing API endpoints for authorization flaws, injection vulnerabilities, and business logic bypasses

• Assessing the security of microservices architecture where APIs are the primary communication method

• Validating that API gateway protections (rate limiting, authentication, input validation) are properly enforced

• Testing third-party API integrations for data exposure and insecure configurations

• Evaluating GraphQL APIs for introspection disclosure, query complexity attacks, and authorization bypasses

Do not use against APIs without written authorization, for load testing or denial-of-service testing unless explicitly scoped, or for testing production APIs that process real financial transactions without safeguards.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• API documentation (OpenAPI/Swagger, GraphQL schema, Postman collection) or application access to reverse-engineer the API
• Burp Suite Professional configured to intercept API traffic with JSON/XML content type handling
• Postman or Insomnia for organizing and replaying API requests across different authentication contexts
• Valid API tokens or credentials at multiple privilege levels (unauthenticated, standard user, admin)
• Target API base URL and version information

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}