I have been encountering more and more clients needing their API (usually REST) endpoints tested for vulnerabilities and wanted to reach out to see if anyone has some recommendations beyond what I have been doing.
I am very familiar with the REST security cheat sheet from OWASP and have built a number of API's myself so I know to look for HTTP methods, CSRF, Sensitive data disclosure, input validation, SSL configs, etc. but am I missing anything? What techniques is everyone doing to go above and beyond to find an API vulnerability / exploit? Any recommended tools that do the job better than a good old intercepting proxy and curl?