API Security - ties2/web-pentest GitHub Wiki

Introduction:

APIs (Application Programming Interfaces) have become a critical component of modern software applications and systems, facilitating seamless data exchange and functionality integration. As the usage of APIs continues to grow, the need for robust API security becomes paramount. API security pentesting, also known as API penetration testing, is a proactive approach to identify vulnerabilities and weaknesses in APIs to protect against potential cyber threats and data breaches.

There are several types of APIs that can be used for penetration testing:

  1. SOAP/XML Web Services: These APIs use the WSDL format for documentation and can be found at ?wsdl paths. Tools like SOAPUI and WSDLer (Burp Suite Extension) are useful for parsing and generating requests.

  2. REST APIs (JSON): These APIs often have documentation in WADL files, but tools like Swagger UI provide a more user-friendly interface for interaction. Postman is a valuable tool for creating and managing example requests.

  3. GraphQL: A query language for APIs that offers a complete and understandable description of the data in your API.

These types of APIs can be used for penetration testing to identify vulnerabilities and weaknesses in the API's security.

Additionally, there are some tools and resources that can be used for API penetration testing, such as:

kiterunner: A tool for discovering API endpoints. automatic-api-attack-tool: A tool for simulating attacks on APIs. Astra: A tool for fuzzing and vulnerability scanning of APIs. restler-fuzzer: A tool for fuzzing and vulnerability scanning of REST APIs. Cherrybomb: An API security tool that audits APIs based on an OAS file. It's also important to note that there are some practice labs and resources available for learning and practicing API penetration testing, such as:

VAmPI: A deliberately vulnerable API for hands-on practice. OWASP API Security Top 10: A guide to understanding common API vulnerabilities. API Security Checklist: A comprehensive checklist for securing APIs.

Importance of API Security Pentesting:

API security pentesting plays a vital role in ensuring the integrity, confidentiality, and availability of API endpoints. The significance of API security pentesting can be summarized as follows:

Risk Mitigation:

API security pentesting helps organizations identify and remediate potential security risks, reducing the likelihood of unauthorized access and data breaches.

Compliance Requirements:

Many industries, such as healthcare and finance, have specific compliance regulations that mandate regular security testing, including API security assessments.

Data Protection:

APIs often handle sensitive data, and securing these endpoints is crucial for protecting the privacy of users and preventing data leaks.

Business Continuity: Ensuring the security of APIs safeguards business continuity, preventing disruptions and loss of trust due to security incidents.

API Security Pentesting Process:

A comprehensive API security pentest follows a well-defined process to identify and address vulnerabilities effectively. The typical steps in the API security pentesting process, aligned with OWASP API Security Top Ten, include:

Scoping and Reconnaissance:

Understand the API's functionality, authentication mechanisms, and endpoints. Identify the potential attack surface and gather information about the API.

Threat Modeling:

Analyze potential threats and attack vectors that could exploit the API's weaknesses.

Vulnerability Assessment:

Perform security assessments using various tools and manual techniques to identify common vulnerabilities like injection attacks, authentication flaws, and data exposure.

Authentication and Authorization Testing:

Verify the API's authentication and authorization mechanisms for weaknesses that could lead to privilege escalation or unauthorized access.

Data Validation:

Test the API for input validation issues to prevent common injection attacks like SQL injection and cross-site scripting (XSS).

Session Management:

Assess the API's session management to ensure secure handling of user sessions and tokens.

Error Handling and Information Leakage:

Evaluate error handling mechanisms to prevent the exposure of sensitive information.

Rate Limiting and Abuse Prevention:

Check for proper rate limiting to prevent abuse and DDoS attacks on the API.

Transport Layer Security:

Verify the use of secure communication protocols like HTTPS to protect data during transit.

API Documentation Review:

OWASP API Security Top Ten reference: https://owasp.org/Top10/

LAb or site to API pentest:

vAPI:

vAPI is a Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises

https://github.com/roottusk/vapi

API security university:

https://university.apisec.ai/

Vampi:

VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. It was created as I wanted a vulnerable API to evaluate the efficiency of tools used to detect security issues in APIs. It includes a switch on/off to allow the API to be vulnerable or not while testing. This allows to cover better the cases for false positives/negatives. VAmPI can also be used for learning/teaching purposes. You can find a bit more details about the vulnerabilities in erev0s.com.

https://github.com/erev0s/VAmPI

Checklist of API

REST API:

  • Test for common vulnerabilities such as Injection, Broken Authentication, Sensitive Data Exposure, XML External Entities (XXE), Broken Access Control, Security Misconfiguration, Cross-Site Scripting (XSS), Insecure Deserialization, and Using Components with Known Vulnerabilities.
  • Check for versioning and test against multiple API versions.
  • Test for weak authentication and authorization mechanisms.
  • Test for weak or missing SSL/TLS encryption.
  • Test for input validation errors and ensure that the API handles unexpected input gracefully.
  • Test for rate limiting and ensure that the API can handle high volumes of traffic.
  • Test for injection vulnerabilities such as SQL injection, Command Injection, and LDAP injection.
  • Test for XML External Entities (XXE) vulnerabilities in XML-based APIs.
  • Test for Cross-Site Scripting (XSS) vulnerabilities in input fields and response data.
  • Test for Insecure Direct Object References (IDOR) vulnerabilities in API endpoints.
  • Test for broken access control vulnerabilities in API endpoints.
  • Test for CORS misconfigurations and ensure that the API is not vulnerable to Cross-Site Request Forgery (CSRF) attacks.

SOAP APIs:

  • Test for common vulnerabilities such as Injection, Broken Authentication, Sensitive Data Exposure, XML External Entities (XXE), Broken Access Control, Security Misconfiguration, Cross-Site Scripting (XSS), Insecure Deserialization, and Using Components with Known Vulnerabilities.
  • Test for versioning and test against multiple API versions.
  • Test for weak authentication and authorization mechanisms.
  • Test for weak or missing SSL/TLS encryption.
  • Test for input validation errors and ensure that the API handles unexpected input gracefully.
  • Test for rate limiting and ensure that the API can handle high volumes of traffic.
  • Test for injection vulnerabilities such as SQL injection, Command Injection, and LDAP injection.
  • Test for XML External Entities (XXE) vulnerabilities in XML-based APIs.
  • Test for Cross-Site Scripting (XSS) vulnerabilities in input fields and response data.
  • Test for Insecure Direct Object References (IDOR) vulnerabilities in API endpoints.
  • Test for broken access control vulnerabilities in API endpoints.
  • Test for CORS misconfigurations and ensure that the API is not vulnerable to Cross-Site Request Forgery (CSRF) attacks.
  • Test for WSDL parsing errors and ensure that the API handles unexpected WSDL input gracefully.

GraphQL APIS:

  • Test for common vulnerabilities such as Injection, Broken Authentication, Sensitive Data Exposure, XML External Entities (XXE), Broken Access Control, Security Misconfiguration, Cross-Site Scripting (XSS), Insecure Deserialization, and Using Components with Known Vulnerabilities.
  • Test for versioning and test against multiple API versions.
  • Test for weak authentication and authorization mechanisms.
  • Test for weak or missing SSL/TLS encryption.
  • Test for input validation errors and ensure that the API handles unexpected input gracefully.
  • Test for rate limiting and ensure that the API can handle high volumes of traffic.
  • Test for injection vulnerabilities such as SQL injection, Command Injection, and LDAP injection.
  • Test for GraphQL query language injection vulnerabilities.
  • Test for Cross-Site Scripting (XSS) vulnerabilities in input fields and response data.
  • Test for Insecure Direct Object References (IDOR) vulnerabilities in API endpoints.
  • Test for broken access control vulnerabilities in API endpoints.
  • Test for CORS misconfigurations and ensure that the API is not vulnerable to Cross-Site Request Forgery (CSRF) attacks.
  • Test for GraphQL schema introspection vulnerabilities.

Tools and Resources for API Pentesting:

  • kiterunner: Excellent for discovering API endpoints. Use it to scan and brute force paths and parameters against target APIs.

  • automatic-api-attack-tool: A tool for automatically testing APIs for common vulnerabilities.

  • Astra: A tool for testing GraphQL APIs for common vulnerabilities.