So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it's the same API backend anyway)? Is there even a difference between pentesting "through" the mobile app vs "through" the web app?
1 Answer
That will depend on what you wish from the testing. What do you wish to test?
If you wish to test your webservice or Serrver side API with the objective that anyone can build a client to interact with it then you just need 1 test to make sure the service is strong and matches your needs.
If you are developing your own front end system to interact with the Server API then you will require to test them also.
Only then you can confirm that your fronted is working properly and cannot be leveraged by any malicious actor to subvert the API.
