Scribd
Upload
12 views3 pages

Procudures

This document outlines a comprehensive process for testing APIs, including preparation, reconnaissance, scanning, authentication testing, and reporting. It emphasizes the use of tools like Burp Suite and Nmap, as well as techniques for identifying vulnerabilities such as injection points and access control issues. The final steps involve documenting findings and providing recommendations for security improvements.

Uploaded by

tnyange909
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
12 views3 pages

Procudures

This document outlines a comprehensive process for testing APIs, including preparation, reconnaissance, scanning, authentication testing, and reporting. It emphasizes the use of tools like Burp Suite and Nmap, as well as techniques for identifying vulnerabilities such as injection points and access control issues. The final steps involve documenting findings and providing recommendations for security improvements.

Uploaded by

tnyange909
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

Step 1: Prepare Your Tools & Environment

Tools Needed:

Burp Suite (or OWASP ZAP)


Nmap/Recon-ng for network reconnaissance
Python scripts or custom fuzzers
API testing tools like Postman
Wordlists (e.g., SecLists)

Environment Setup:

Set up Burp Suite as a proxy to intercept and modify traffic


Ensure you have valid credentials or session tokens if needed
Isolate testing environment to prevent accidental impact

Step 2: Reconnaissance & Initial Mapping

Review All Endpoints:


Use the list of 192 endpoints.
Use Burp Suite or Postman to send GET requests to each endpoint.

Check Responses for Sensitive Data:


Look for debug info, internal IPs, API keys, or secrets.
Save responses that contain sensitive info.

Identify Authentication & Authorization:


Determine which endpoints require login.
Test if you can access protected endpoints without credentials or with different user roles.

Step 3: Automate Basic Scanning & Fuzzing

Create a List of Payloads:


For injection points: SQLi, command injection, path traversal.
For parameter tampering: alter IDs, tokens.

Use Burp Intruder or ZAP Active Scan:


Target endpoints with parameters.
Fuzz with payloads like ' OR 1=1 --, ../, <script>alert(1)</script>.

Identify Weaknesses:
Look for injection points or error messages revealing vulnerabilities.

Step 4: Test Authentication & Session Management

Check for Session Fixation or Reuse:


Capture tokens or session cookies.
Replay or manipulate them to see if session fixation is possible.

Test for Privilege Escalation:


Access endpoints as a standard user.
Attempt to access admin or higher-privilege endpoints (/api/v2/accounts, /api/v2/collector,
etc.).

Look for Broken Access Controls:


Try changing resource IDs (e.g., user IDs) to access other users' data.

Step 5: API-Specific Testing

Test Data Exposure:


Check if sensitive data (e.g., user info, tokens) appears in responses.

Parameter Manipulation:
Alter parameters like id, type, token to see if insecure operations occur.

Undocumented Endpoints:
Review swagger.json and swagger.yaml.
Test endpoints with different HTTP methods and payloads.

Step 6: Check for Security Misconfigurations

CORS & CSRF:


Use browser dev tools or Burp to see if cross-origin requests are allowed.
Test if endpoints accept cross-site requests.

Token Security:
Inspect tokens from /api/token.
Check for weak or predictable tokens.

Step 7: Business Logic & Workflow Testing

Simulate Typical User Flows:


Log in, create a cart, make a purchase.
Attempt to bypass steps or manipulate data.

Test for Race Conditions or Replays:


Resubmit requests with the same data.
Check if duplicate actions occur.

Step 8: Document & Verify Vulnerabilities

Capture Proofs:
Screenshots, request/response logs.
Exploit code snippets.

Verify & Reproduce:


Ensure vulnerabilities are consistent.
Check if fixes are needed.

Step 9: Reporting

Prepare a detailed report with:


Endpoint details
Vulnerability description
Reproduction steps
Impact assessment
Recommended fixes

You might also like