API penetration testing
API penetration testing checks the interfaces your applications, partners and mobile apps call directly, where there is no user interface to hide behind. HYDN tests authentication and authorisation on every endpoint, object level access control, mass assignment, rate limiting, input handling and business logic abuse, across REST, GraphQL and JSON-RPC APIs.
What we test
- Authentication. How tokens and API keys are issued, validated, scoped and revoked.
- Object level authorisation. Whether changing an ID in a request returns someone else’s data. This is the most common serious API flaw we see.
- Function level authorisation. Whether ordinary users can call admin endpoints by guessing their paths.
- Mass assignment. Whether a client can set fields it should not, such as a role, balance or account status, by adding them to a request.
- Rate limiting and resource use. Brute force, enumeration and requests expensive enough to degrade the service.
- Input handling. Injection, deserialisation, and server-side request forgery through URLs the API fetches.
- Business logic. Sequences of legitimate calls that together do something they should not.
- Data exposure. Responses that return more than the client needs, including internal fields and other users’ details.
Where APIs show up in web3
Exchanges, wallets and dApps all depend on APIs: trading and withdrawal endpoints, price and balance services, node and RPC endpoints, and the indexers behind front ends. We test these alongside the contracts, because attackers move between the two. See crypto exchange testing.
Frequently asked questions
What do you need from us for an API test?
API documentation or an OpenAPI or GraphQL schema, test accounts at each privilege level, and an environment we can test without affecting real users. The more we know, the more of the API we can cover in the time.
Do you test blockchain RPC endpoints?
Yes. JSON-RPC endpoints, node APIs and indexer APIs are a common part of web3 engagements.
Published Updated