API Penetration Testing Service
Digital Roxy runs manual API penetration tests against REST, GraphQL, and gRPC APIs to the OWASP API Security Top 10 standard. Every engagement maps authorization across every endpoint and role. OSCP-certified testers, manual exploitation, CVSS-scored findings, and compliance attestation.
API pentest is where broken authorization hides in plain sight.
An API penetration test is a manual security assessment of a REST, GraphQL, or gRPC API. The single most valuable thing an API pentest delivers is a complete authorization map. Every endpoint multiplied by every role gives you a grid, and testing each cell of that grid is where Broken Object-Level Authorization (BOLA) and Broken Function-Level Authorization (BFLA) findings emerge. These two issues are #1 and #5 on the OWASP API Security Top 10 because they are the most common and most damaging API vulnerabilities in production.
Digital Roxy API pentests cover all ten OWASP API Top 10 categories, plus authentication flows (OAuth 2.1, JWT, API keys, mTLS), rate limiting and resource consumption testing, mass assignment on data models, excessive data exposure through response shapes, and injection in query parameters, bodies, and GraphQL queries. Every endpoint gets tested against every role. Every finding is manually exploited with proof-of-exploit captures showing the exact request, response, and business impact.
API Vulnerability Classes We Exploit
OWASP API Security Top 10 is a useful taxonomy. These are the specific bugs within that taxonomy that we actually find in production.
Broken Object-Level Authorization (BOLA, API1)
The #1 API vulnerability class in production. GET /api/users/12345 returns data without verifying the authenticated user owns user 12345. Iterating IDs exposes every user. We test every endpoint that takes an object ID against every role. Takes time, finds bugs.
Broken Function-Level Authorization (BFLA, API5)
Admin-level endpoints callable by non-admin users. /api/admin/users/delete returning 200 instead of 403 for a regular user. Usually caused by authorization checked in the UI but not enforced in the API. We map every endpoint against every role to catch this.
Mass Assignment (API6)
PATCH /api/users/me with a request body that includes {"role":"admin"} successfully elevating the user. Rails and Django apps are especially prone to this when strong parameters or serializer allowlists are not enforced. Manual testing with unexpected field names catches it.
Excessive Data Exposure (API3)
GET /api/users/me returning all user fields including hashed password, reset token, and internal flags. The UI only displays five fields, but the API returns 40. Easy to miss in review because the UI looks correct.
Broken User Authentication (API2)
JWT algorithm confusion (accepting both RS256 and HS256). Password reset tokens that do not expire. Refresh tokens that do not rotate. OAuth state parameter not verified. Session fixation on login. Authentication flaws in APIs turn into full account takeover.
Resource Consumption / Rate Limiting (API4)
Endpoints that accept pagination parameters without bounds (PageSize=1000000). Endpoints accepting arbitrary-depth nested GraphQL queries. Expensive operations (PDF generation, image resizing) without user-level rate limits. Leads to DoS and infrastructure cost abuse.
GraphQL-Specific Issues
Introspection enabled in production exposing the full schema. Nested query complexity without depth limits. Field-level authorization enforced inconsistently across resolver chains. Batched query abuse. GraphQL adds attack surface that REST does not have.
Injection Through API Inputs (API8)
SQL injection through JSON body fields. NoSQL injection through MongoDB operators in query parameters. Command injection through user-controlled arguments in backend tool wrappers. Server-side template injection in dynamic content generators.
Our API Pentest Methodology
Methodology aligned with OWASP API Security Top 10 2023 and OWASP API Security Testing Guide. Full endpoint-by-role coverage is non-negotiable.
API Endpoint Discovery
OpenAPI specs, Postman collections, GraphQL introspection responses, and mobile-app reverse engineering all feed into endpoint discovery. For undocumented APIs, we crawl the consuming clients (web app, mobile app) to map the actual endpoints in use. Shadow APIs and deprecated endpoints often contain the most interesting findings.
Authentication Review
JWT analysis (algorithm confusion, weak secrets, missing kid validation, expiration handling). OAuth 2.1 flow review (state parameter, PKCE, redirect URI validation). API key lifecycle review. mTLS implementation review where used. Refresh token rotation and revocation testing.
Authorization Map
Build a matrix: endpoints x HTTP methods x user roles. Every cell gets tested to verify the expected authorization behavior. This is the single most productive phase of API pentests. BOLA and BFLA findings come from this phase.
Injection Testing
SQL, NoSQL, command, template, and XPath injection against every user-controlled input. JSON body fields get tested alongside URL and query parameters. For GraphQL, field-level injection across the schema.
Business Logic Testing
API-specific business logic issues: mass assignment, excessive data exposure, IDOR patterns that require chaining multiple endpoints. Race conditions on state-changing endpoints. Workflow state bypass through endpoint reordering.
Rate Limiting & Resource Testing
Rate limit bypass through header manipulation (X-Forwarded-For), endpoint variation, and case-sensitivity tricks. Resource consumption testing on expensive endpoints. GraphQL query depth and complexity testing.
Report & Retest
OWASP API Top 10 mapped findings. Full authorization matrix as an appendix. CVSS-scored findings with exploit reproduction steps. Free retest after fixes ship.
Our API Pentest Toolset
API pentest tooling overlaps with web, but adds specialization for GraphQL, gRPC, and modern authentication protocols.
Burp Suite Pro + Postman
Primary request-response inspection and tampering. Postman for structured endpoint exploration from OpenAPI specs.
graphql-voyager + InQL
GraphQL schema exploration and introspection abuse testing. Critical for engagements that include GraphQL.
ffuf + Arjun
Endpoint and parameter discovery. Arjun for hidden parameters that clients send but documentation omits.
jwt_tool + jwtcrack
JWT analysis, algorithm confusion, weak secret cracking, key injection. JWT flaws are common enough to warrant specialized tooling.
Autorize + AuthMatrix
Burp extensions for automated authorization testing. Run all requests across all roles and flag discrepancies.
Custom Python tooling
For OAuth flow manipulation, gRPC service testing, and any authentication pattern that standard tools miss.
API Pentest Engagement Tiers
Three engagement sizes. Every quote is fixed-price after a 15-minute scoping call. No hourly billing.
Focused API
Single API with under 50 endpoints and up to 3 roles. Right for startups with a focused product surface.
- OWASP API Top 10 coverage
- Authorization matrix testing
- Authentication flow review
- 1-week engagement
- One free retest
- Technical + executive report
- Compliance attestation
Platform API
API with 50-200 endpoints and 4-8 roles. Right for mid-market SaaS and enterprise platforms.
- Everything in Focused API
- Full endpoint x role matrix
- Rate limiting & resource testing
- Shadow API discovery
- GraphQL testing if applicable
- 2-3 week engagement
- Developer debrief call
- Two free retests
Public API
Developer-facing public APIs with third-party consumers. Documentation review plus security testing.
- Everything in Platform API
- OpenAPI spec security review
- Third-party integration risk review
- API abuse scenario testing
- Key lifecycle and scope review
- Public developer docs security audit
- Dedicated 30-day Slack support
API Pentest Questions, Answered Directly
Explore Related Penetration Tests
Ready to scope your API Pentest?
Book a 15-minute scoping call. You get a fixed-price quote within one business day.