In order to test the security of my API, I want to act as sort of an attacker in order to try and gain access to my own API without an API key.

In order for me to send requests to this endpoint, I need to include a 32 long character string (API key/cert) in the header of the request. This means I basically can't brute force an API key, it would take ages.

What other options are out there for me to exploit and gain access to this endpoint? Is my API secure against a possible attack?

The information I know as an "attacker" is that the server the API runs on is Microsoft-IIS/8.5, running ASP.NET version 4.0.30319, and that this is a REST API.


There is not much known about your actual setup. But apart from trying to guess the key (i.e. brute forcing) the attacker might also

  • Try to sniff the key on the wire
    Proper use of HTTPS will protect against this unless the attacker can make the client accept its own certificate and thus be a man in the middle.
  • Extract the key from the client side
    Nothing is known about the client application. But a mobile application using the key might be reverse engineered, in a web application the attacker might use developer console to see the actual traffic in plain, XSS issues in the client application might allow the attacker to extract the key from the client ...
  • Hack the server side and extract the key
    For example using an SQL injection if the key is stored in a database etc
  • And maybe through other ways
    For example because the developer inadvertently leaks the key when publishing the source code etc

Is my API secure against a possible attack?

Your title asks about unauthorized access while this part asks about "secure against attacks" in general. Securing the key is not the only thing for securing an API. You should never assume that only a client fully controlled by you can use the API. This means you should also have proper input validation of what the client sends and not rely on the client to send only valid input. Additionally to this there are other attacks like DoS and maybe more. Again, too few is known about your actual setup in order to evaluate the security in more detail.

In summary: if you rely solely on the secrecy of the key your API is likely not secure against attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.