Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been encountering more and more clients needing their API (usually REST) endpoints tested for vulnerabilities and wanted to reach out to see if anyone has some recommendations beyond what I have been doing.

I am very familiar with the REST security cheat sheet from OWASP and have built a number of API's myself so I know to look for HTTP methods, CSRF, Sensitive data disclosure, input validation, SSL configs, etc. but am I missing anything? What techniques is everyone doing to go above and beyond to find an API vulnerability / exploit? Any recommended tools that do the job better than a good old intercepting proxy and curl?

share|improve this question
1  
That cheat sheet is pretty good. I've had most results from injection, session management, and insecure direct object references. For SOAP services, SOAPui is pretty good, but I don't know an equivalent for REST. –  paj28 Feb 6 at 1:45

2 Answers 2

My favorite RESTful client is httpie (from Python sources). Easily get it via easy_install httpie or pip install httpie. There are a few REST clients/debuggers as Firefox add-ons (search via addons.mozilla.org).

While at a certain company, I recall using a WebInspect feature called "custom parameters" against RESTful Web Services, such as the REST-WS demo in the Maven Security Web Security Dojo virtual machine or the OWASP GoatDroid Project's use of JAX-RS. If you also have access to the Fortify SecurityScope product, you can use use it to automatically create a WADL which in turn can be consumed by WebInspect RT. When testing large apps (e.g., greater than two million lines of code), this can be especially useful -- voice of experience here.

When you look at the SecToolMarket report, most of the tools that have under 9 input vectors cannot handle RESTful Web Services very well, and even the best ones (Burp Suite Professional, NTOSpider, IBM Appscan, etc) don't have a clear path to testing these interfaces/APIs. This is often why you'd want to use a tool like httpie (or curl) through them as an intercepting proxy, along with the appropriate API documentation (probably preferably in WADL format).

share|improve this answer

You are missing one important thing:

giving end users training/information on data security

Phishing & Social Engineering are your biggest risk factors in any deployment

share|improve this answer
    
Totally agree on user training and awareness. The question is really about technical controls and testing suggestions as that is really all I have control over in the pen testing world. –  jmbmxer Feb 5 at 22:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.