Module 13 · API Penetration Testing Methodology

Last updated: April 29, 2026

Why this module. API pentesting is different from web app pentesting. Less UI, more state, more business logic. The OWASP API Top 10 maps the bug classes; this module is the methodology to find them.

The phases

1. Enumeration — find every endpoint. OpenAPI specs, browser inspection, app traffic captures, mobile app reverse engineering.
2. Auth model mapping — what auth does each endpoint require? Anonymous, API key, OAuth, mTLS?
3. BOLA testing — can user A access user B’s objects? Sequential ID enumeration; UUID guessing.
4. Mass assignment — can client set fields they shouldn’t? Try sending "is_admin": true.
5. Excessive data exposure — does response include fields not needed? Sometimes /users/me returns the password hash.
6. Rate limiting — test bypass via headers, distributed sources.
7. Business logic — race conditions (Module 23, Web track), state machine bypass.
8. Versioning — does v1 still work? Same security as v2?

Tools for API pentesting

• Burp Suite — Repeater, Intruder, the bread-and-butter
• Postman — for collection-based exploration
• OWASP ZAP — open source alternative
• Frida / Objection — for mobile API capture
• OpenAPI fuzzers — RESTler, Schemathesis, Dredd
• JWT_Tool — JWT-specific testing

The high-yield checks

1. Try every endpoint without auth — many APIs have at least one unauthenticated leak
2. Try every endpoint with low-priv auth — many endpoints over-trust authenticated state
3. Mass-assign every field — try id, user_id, is_admin, email
4. Sequential enumeration — /users/1, /users/2 — most apps don’t scope check
5. Method tampering — GET → POST, PUT, DELETE on the same path
6. Old version — try v1 of every v2 endpoint; security may be weaker

Reporting

Each finding documented:

• Endpoint + method
• Reproduction steps (curl command)
• Impact
• OWASP API Top 10 category
• Recommended fix
• Risk rating

Defender’s checklist

• API pentest at least annually; quarterly for high-stakes.
• Methodology documented.
• Reports tracked in vuln management.
• Top findings re-tested next cycle (regression).