What is Web Service and API Penetration Testing?
A Web Service & API Penetration Test is an authorized hacking attempt aimed at identifying and exploiting vulnerabilities in the architecture and configuration of a web service. The purpose of this test is to demonstrate the ways attackers can compromise a web service and gain access to an organization’s virtual assets.
Why this is Important ?
APIs are used by enterprises to link services and transfer data. Major data breaches are caused by APIs that are malfunctioning, disclosed, or abused. They render sensitive medical, financial, and personal information available to the public. However, not all data is created equal, and not all data should be safeguarded in the same way. If your API connects to a third-party application, it is important to understand how that app is funneling information back to the internet.
OUR WEB SERVICE AND API PENTEST METHODOLOGY
1. SCOPE DEFINITION:
We collect scoping/target information from your organization at the start of the project. The IP addresses, URLs, definition files or documentation for all endpoint definitions, authentication credentials, and API tokens associated with the target are all included in this information.
2. INTELLIGENCE GATHERING:
In this phase, we gather as much information as possible about the target using publicly available resources. We then proceed with crawling of the web service using a combination of manual and automated tools and analyse the service paths within the scope. The goal of this phase is to identify any sensitive information that can be leveraged in later phases to compromise the web service/API.
3. VULNERABILITY ANALYSIS:
This phase includes listing the target web service and/or API on both the application and network layers. The exposed endpoints are then actively scanned and manually reviewed to determine their business functionality and identify the unauthenticated/authenticated endpoint attack surface. For all in-scope endpoints, an application proxy is used to intercept normal webservice/API interactions. Traffic at the packet level and response headers are also examined.
4. EXPLOITATION:
We attempt to exploit the vulnerabilities discovered in previous phases of the assessment in this phase. This step assists in determining the realistic risk level associated with successful vulnerability exploitation and validating whether any mitigating controls are already in place.
5. REPORTING:
Redback provides an assessment report after completing the assessment, which includes an executive summary and technical findings. The executive summary is written for senior management and provides a high-level overview of assessment activities, scope, most critical issues discovered, and overall risk scoring. We also provide strategic recommendations to help business leaders make informed decisions about the application. All vulnerabilities are listed individually in the technical findings, along with details for reproducing the issue with required screenshots, understanding of the potential risk, recommended remediation actions, and helpful reference links.
