Advanced Web, API & Modern Stack
API Pentesting Methodology
REST, GraphQL, SOAP & gRPC — and the BOLA/BFLA bugs that dominate APIs.
Modern apps are APIs with a thin UI. APIs have their own OWASP Top 10, and the biggest hitters are authorization flaws — because APIs expose object and function access directly.
The API-specific big three
- BOLA (Broken Object Level Authorization) — API-scale IDOR: /api/orders/1234 without an ownership check.
- BFLA (Broken Function Level Authorization) — calling admin-only functions/methods as a normal user (try PUT/DELETE).
- Excessive Data Exposure — the API returns full objects and the UI just hides fields (read the raw JSON).
- REST — resource URLs + methods; test every method, not just GET.
- GraphQL — single endpoint; introspection + field-level auth (see the GraphQL lab).
- SOAP — XML-based; watch for XXE and verbose faults.
- gRPC — protobuf over HTTP/2; use grpcurl and reflection to enumerate methods.