Applications
API penetration testing
REST and GraphQL surfaces, including the endpoints that never made it into the documentation.
Coverage
What a mission examines
Every finding is validated by exploitation before it is reported, so what arrives is a demonstrated path rather than a list of possibilities.
- Undocumented endpoints
- Discovered through behaviour rather than read from a specification that is out of date.
- Object-level authorisation
- Whether changing an identifier returns data belonging to someone else.
- Function-level authorisation
- Whether a standard account can call administrative operations.
- GraphQL specifics
- Introspection exposure, nested query abuse and batching attacks.
- Rate and quota controls
- Whether limits exist and whether they can be bypassed.
- Token handling
- Issuance, expiry, scope and what happens when a token is replayed.
In practice
APIs fail on authorisation far more than on injection
The dominant API weakness is not a clever payload. It is an endpoint that checks whether you are logged in but never checks whether the record you asked for is yours.
That class of flaw is invisible to signature matching and trivial to exploit once found, which is why it deserves a testing approach that actually attempts the access.
See what a apis mission actually returns.
Read a finding