Web API Tests

Tests

• Penetration test
  • Black Box
  • Grey Box
  • White Box

Vulnerabilities

• Information Disclosure
• Broken Object Level Authorization (BOLA)
• Broken User Authentication
• Excessive Data Exposure
• Lack of Resources and Rate Limiting
• Broken Function Level Authorization (BFLA)
• Mass Assignment
• Security Misconfiguration
• Injection Flaws
• Improper Assets Management
• Business Logic Flaws (BLF)

Security

• OWASP Foundation
  • OWASP API Security Project
• NVD
• JVN
  • JVN iPedia

Bug Bounty

• Bugcrowd
• HackerOne

Academy

• PortSwigger
  • Web Security Academy
• Postman Docs
• Cybrary
• Black Hills Information Security
• Null Byte
• Hacking Articles

Testing

• Kali Linux
• Burp Suite
  • [Proxy]
    • [Intercept]-[Open Browser] Chromium
  • [Intruder]
    • [Positions]
      • Attack type
        • Sniper
        • Battering ram
        • Pitchfork
        • Cluster bomb
    • [Payloads]
• Google Chrome
  • FoxyProxy
• Postman
  • HTTP
    • [Params]
    • [Authorization]
    • [Headers]
    • [Body]
    • [Scripts]
      • Pre-request
      • Post-response
    • [Settings]
    • Code snippet
      • Code
  • Collection
    • Public collections
    • Collection Runner
  • Environment
    • Variable
      • Type
      • Initial value
      • Current value

Tools

• OWASP Amass
  • 
• OWASP ZAP
  • 
• Kiterunner
  • 
• Nikto
  • 
• Wfuzz
  • 
• Arjun
  •