API Testing Methodology

1. Information Gathering

Start by gathering API details like documentation and authentication methods.

Example Request:

GET /api/v1/docs

---

2. Authentication Testing

Check if the API correctly handles authentication.

Example Request:

POST /api/v1/login
{
   "username": "admin",
   "password": "password123"
}

---

3. Broken Object Level Authorization

Test whether users can access objects they aren't authorized for.

Example Request:

GET /api/v1/accounts/12345
Authorization: Bearer jwt_token

---

4. SQL Injection Testing

Test for injection vulnerabilities.

Example Request:

POST /api/v1/users
{
   "username": "' OR 1=1--",
   "password": "anything"
}

---

5. Rate Limiting and DoS

Check for rate-limiting and denial of service.

Example Request:

POST /api/v1/upload
<huge_file>

---

6. Security Misconfiguration Testing

Verify the API configuration for security.

Example Request:

OPTIONS /api/v1/resource

---

7. Server-Side Request Forgery (SSRF)

Test for SSRF vulnerabilities.

Example Request:

POST /api/v1/fetch-data
{
   "url": "http://localhost:8080/admin"
}

---

8. Response Data Validation

Ensure the API doesn't expose unnecessary sensitive data.

Example Request:

GET /api/v1/user/profile

---

9. Cross-Site Scripting (XSS)

Check if the API allows injection of scripts that execute in the browser.

Example Request:

POST /api/v1/comments
{
   "comment": "<script>alert('XSS')</script>"
}

---

10. JSON Web Token (JWT) Manipulation

Test the API's handling of JWTs by tampering with the token's payload.

Example Request:

GET /api/v1/accounts
Authorization: Bearer [Tampered JWT Token]

---

11. XML External Entity (XXE) Injection

Test APIs that handle XML payloads for XXE vulnerabilities.

Example Request:

POST /api/v1/xml-parser
<?xml version="1.0"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<user>
    <name>&xxe;</name>
</user>

---

12. Mass Assignment

Test if the API automatically assigns input data to model attributes, leading to unauthorized data manipulation.

Example Request:

POST /api/v1/users
{
   "username": "new_user",
   "isAdmin": true
}

---

13. Lack of Input Validation

Test for weak or non-existent input validation, which can lead to various vulnerabilities.

Example Request:

POST /api/v1/register
{
   "username": "<invalid_characters>",
   "password": "123"
}

---

14. Parameter Tampering

Check if the API allows modification of parameters that should be fixed or immutable.

Example Request:

POST /api/v1/checkout
{
   "item_id": "12345",
   "price": "1.00"
}

---

15. HTTP Method Manipulation

Test if sensitive resources respond to unexpected HTTP methods.

Example Request:

DELETE /api/v1/users/12345

---

16. File Upload Vulnerabilities

Check if the API properly handles file uploads (e.g., malware, large files, improper file types).

Example Request:

POST /api/v1/upload
{
   "file": "malicious.php"
}

---

17. Brute Force Attacks

Check for weak points where brute force attacks could be applied, such as login endpoints.

Tip: Use tools like Burp Suite to automate testing for multiple login attempts.

---

18. Content-Type Validation

Test how the API handles various Content-Type headers to ensure it's properly validated.

Example Request:

POST /api/v1/submit-data
Content-Type: application/xml
{
   "json_data": "malformed_data"
}

---

19. Privilege Escalation

Check for endpoints that allow unauthorized privilege escalation.

Example Request:

POST /api/v1/promote
{
   "user_id": "12345",
   "role": "admin"
}

---

20. CORS Misconfiguration

Test for Cross-Origin Resource Sharing (CORS) misconfigurations that might allow unauthorized domains to access the API.

Example Request:

GET /api/v1/resource
Origin: evil.com

---

21. API Schema Poisoning

Test how the API handles unexpected schema changes in JSON or XML payloads.

Example Request:

POST /api/v1/data
{
   "unexpected_field": "malicious_value"
}

---

22. HTTP Host Header Attack

Test if the API is vulnerable to attacks through manipulation of the HTTP Host header.

Example Request:

GET /api/v1/resource
Host: malicious.com

---

23. HTTP Parameter Pollution

Test if the API correctly handles multiple parameters with the same name.

Example Request:

GET /api/v1/resource?param=value1&param=value2

---

24. Hidden Endpoints

Look for unlisted or hidden endpoints by fuzzing or reviewing the API documentation.

Tip: Use tools like FFUF or Dirb to brute force possible API endpoints.

---

25. Third-Party Integrations

Test the security of API endpoints that interact with third-party services (OAuth, webhooks, etc.).

Example Request:

POST /api/v1/webhook
{
   "payload": "malicious_data"
}

---

26. Error Code Handling

Check how the API handles various error codes and if it leaks any sensitive information.

Tip: Check for verbose error messages revealing stack traces, database queries, or environment information.

---

27. Improper Asset Management

Ensure that all endpoints and API versions are properly managed and decommissioned if no longer in use.

Tip: Verify if older versions of the API are still accessible and whether they have security flaws.