APIs are the backbone of modern web applications, mobile apps, and microservice architectures. This category tests the security of different API technologies, each with unique attack surfaces and common vulnerabilities. GraphQL APIs face introspection abuse and query complexity attacks, REST APIs are vulnerable to broken authentication and mass assignment, SOAP APIs have XML-specific injection risks, and WebSocket APIs often lack the security controls applied to traditional HTTP endpoints. As organizations adopt API-first architectures, the attack surface shifts from traditional web pages to API endpoints, making API security testing essential. These tests are increasingly important for security certifications and real-world penetration testing engagements.
OWASP Top 10 Mapping
This testing category relates to the following OWASP Top 10 2021 categories:
Quick Reference
| Test ID | Name | CWEs | Difficulty |
|---|---|---|---|
| WSTG-APIT-01 | GraphQL Testing | CWE-200, CWE-285, CWE-89 | Advanced |
| WSTG-APIT-02 | REST API Testing | CWE-285, CWE-639, CWE-918 | Advanced |
| WSTG-APIT-03 | SOAP API Testing | CWE-611, CWE-89, CWE-200 | Advanced |
| WSTG-APIT-04 | WebSocket API Testing | CWE-346, CWE-285, CWE-319 | Advanced |
Detailed Test Cases
WSTG-APIT-01: GraphQL Testing
AdvancedGraphQL testing evaluates the security of GraphQL API implementations including introspection exposure, query depth and complexity limits, authentication and authorization on resolvers, and injection vulnerabilities in query variables. GraphQL's flexibility creates unique attack surfaces not found in traditional REST APIs.
What to Check
- Test if introspection queries are enabled and expose the full API schema
- Check for query depth and complexity limits that prevent denial of service
- Test authorization enforcement on individual query and mutation resolvers
- Look for injection vulnerabilities in GraphQL variables and arguments
- Test for batch query attacks and circular reference exploitation
WSTG-APIT-02: REST API Testing
AdvancedREST API testing evaluates the security of RESTful API endpoints including authentication mechanisms (API keys, OAuth, JWT), authorization enforcement on resources, input validation, rate limiting, and proper HTTP status code usage. REST APIs are the most common API type in modern applications.
What to Check
- Test authentication mechanisms (API keys, JWT, OAuth tokens) for bypass opportunities
- Check for BOLA/IDOR by modifying resource IDs to access other users' data
- Test for mass assignment by adding extra fields to POST/PUT requests
- Verify rate limiting on sensitive endpoints (login, registration, data export)
- Check API versioning and deprecated endpoints for weaker security controls
WSTG-APIT-03: SOAP API Testing
AdvancedSOAP API testing evaluates the security of SOAP-based web services including XML parsing vulnerabilities (XXE), WSDL exposure, WS-Security implementation, and injection attacks through SOAP message parameters. SOAP services are common in enterprise and legacy systems.
What to Check
- Check if WSDL files are publicly accessible and reveal sensitive API structure
- Test for XML External Entity (XXE) injection in SOAP request bodies
- Verify WS-Security implementation for authentication and message integrity
- Test SOAP parameters for SQL injection and command injection
- Check for XML entity expansion denial of service (billion laughs attack)
WSTG-APIT-04: WebSocket API Testing
AdvancedWebSocket API testing evaluates the security of WebSocket-based APIs used for real-time bidirectional communication. This includes testing the handshake process, message authentication and authorization, input validation on WebSocket frames, and encryption requirements.
What to Check
- Verify that the WebSocket handshake validates the Origin header
- Test if authentication tokens are validated on each WebSocket message, not just the handshake
- Check for injection vulnerabilities in WebSocket message content
- Verify that sensitive WebSocket APIs use the encrypted wss:// protocol
- Test for authorization bypass by subscribing to channels or topics belonging to other users
Relevant Certifications
The following certifications cover api testing concepts:
Frequently Asked Questions
What are the main security differences between REST and GraphQL APIs?
REST APIs use fixed endpoints with defined response structures, while GraphQL uses a single endpoint where clients specify exactly what data they want. GraphQL introduces unique risks including introspection queries that reveal the entire API schema, deeply nested queries that cause denial of service, and batch query attacks. REST APIs are more susceptible to broken object-level authorization (IDOR) and mass assignment. Both require strong authentication, authorization, and input validation.
Why are APIs often less secure than web applications?
APIs are often less secure because they are designed for machine-to-machine communication and may skip security controls that web applications include by default, such as CSRF protection, rate limiting, and WAF coverage. APIs also frequently lack the same level of authentication and authorization enforcement as web interfaces, especially internal APIs that were not designed for public exposure.
What is the OWASP API Security Top 10 and how does it relate to WSTG?
The OWASP API Security Top 10 is a separate project focused specifically on API security risks, including Broken Object Level Authorization, Broken Authentication, Excessive Data Exposure, and Injection. WSTG-APIT tests complement this by providing practical testing procedures for different API technologies. Together, they provide comprehensive coverage for API security assessment.
CyberFolio
Mastering web security testing? Showcase your skills.
Build a free, shareable cybersecurity portfolio that highlights your certifications, projects, and skills.
Build Your Portfolio →