Systematically assesses REST, GraphQL, and gRPC API endpoints against the OWASP API Security Top 10 (2023) using Burp Suite and Postman for automated and manual testing. Use during authorized API penetration tests, before deploying new endpoints to production, or when validating API gateway controls

Testing API Security with OWASP Top 10 When to Use During authorized API penetration testing engagements When assessing REST, GraphQL, or gRPC APIs for security vulnerabilities Before deploying new API endpoints to production environments When reviewing API security posture against the OWASP API Security Top 10 (2023) For validating API gateway security controls and rate limiting effectiveness Prerequisites Authorization : Written scope document covering all API endpoints to be tested Burp Suite Professional : For intercepting and modifying API requests Postman : For organizing and executing API test collections ffuf : For API endpoint and parameter fuzzing curl/httpie : Command line HTTP clients for manual testing API documentation : Swagger/OpenAPI spec, GraphQL schema, or API docs jq : JSON processor for parsing API responses ( apt install jq ) Workflow Step 1: Discover and Map API Endpoints Enumerate all available API endpoints and understand the API surface. Step 2: Test API1 Broken Object Level Authorization (BOLA) Test whether users can access objects belonging to other users by manipulating IDs. Step 3: Test API2 Broken Authentication Assess authentication mechanisms for weaknesses. Step 4: Test API3 Broken Object Property Level Authorization Test for excessive data exposure and mass assignment vulnerabilities. Step 5: Test API4/API6 Rate Limiting and Unrestricted Access to Sensitive Flows Verify rate limiting and resource consumption controls. Step 6: Test API5 Broken Function Level Authorization Check for privilege escalation through administrative endpoints. Step 7: Test API7 API10 SSRF, Misconfiguration, Inventory, and Unsafe Consumption Key Concepts Concept Description BOLA (API1) Broken Object Level Authorization accessing objects belonging to other users Broken Authentication (API2) Weak authentication mechanisms allowing credential stuffing or token manipulation BOPLA (API3) Broken Object Property Level Authorization excessive data exposure or mass assignment Unrestricted Resource Consumption (API4) Missing rate limiting enabling DoS or brute force attacks Broken Function Level Auth (API5) Regular users accessing admin level API functions SSRF (API7) Server Side Request Forgery through API parameters accepting URLs Security Misconfiguration (API8) Missing security headers, verbose errors, permissive CORS Improper Inventory (API9) Undocumented, deprecated, or shadow API endpoints left exposed Tools & Systems Tool Purpose Burp Suite Professional API interception, scanning, and manual testing Postman API collection management and automated test execution ffuf API endpoint and parameter fuzzing Kiterunner API endpoint discovery using common API path patterns jwt tool JWT token analysis, manipulation, and attack automation GraphQL Voyager GraphQL schema visualization and introspection analysis Arjun HTTP parameter discovery for API endpoints Common Scenarios Scenario 1: BOLA in E commerce API User A can access User B's order details by changing the order ID in /api/v1/orders/{id} . The API only checks authentication but not authorization on the object level. Scenario 2: Mass Assignment on User Profile The user update endpoint accepts a role field in the JSON body. By adding "role":"admin" to a profile update request, a regular user escalates to administrator privileges. Scenario 3: Deprecated API Version Bypass The /api/v2/users endpoint has proper rate limiting, but /api/v1/users (still active) has no rate limiting. Attackers use the old version to brute force credentials. Scenario 4: GraphQL Introspection Data Leak GraphQL introspection is enabled in production, exposing the entire schema including internal queries, mutations, and sensitive field names that are not used in the frontend. Output Format

testing-api-security-with-owasp-top-10