I researched over the internet but I couldn't find any tool/ways for checking the OWASP Top 10 vulnerability - Underprotected APIs. Please anyone can suggest how to proceed with testing Underprotected APIs vulnerability.


Please be aware that only the proposal for the 2017 Top 10 included A10 Underprotected APIs. It is not in the official release. That's why you are not seeing any official guidance on how to test for it. If you look at the historical versions, you can find the official guidance: https://www.owasp.org/index.php?title=Top_10_2017-A10-Underprotected_APIs&oldid=228947

Testing your APIs for vulnerabilities should be similar to testing the rest of your application for vulnerabilities. All the different types of injection, authentication, access control, encryption, configuration, and other issues can exist in APIs just as in a traditional application.

Not the answer you're looking for? Browse other questions tagged or ask your own question.