API penetration testing
The most damaging API flaws look like normal traffic. When one customer's request returns another customer's data, a scanner sees a successful response and moves on. We test your REST and GraphQL APIs by hand, with real accounts at every permission level, against the OWASP API Security Top 10.
What we test
Every engagement is scoped to your environment. These are the areas a api testing engagement covers as standard.
Object level authorization
Whether each user can only reach their own records, across every endpoint that looks data up.
Function level authorization
Whether admin and internal functions are closed to ordinary users, including older API versions.
Authentication and tokens
Token handling, expiry and revocation, API keys and OAuth flows.
Data exposure
Responses that return more than the client needs, and fields users can change but should not.
Abuse and limits
Rate limits, pagination, bulk operations and expensive queries, including GraphQL depth limits.
Server-side risks
Injection through parameters and request bodies, and whether the server can be made to call internal systems.
How deep we go
Choose how much access we start with. We will recommend one on the scoping call, based on what you want to learn.
Schema-led
We start from your documentation and cover every documented endpoint and method.
Traffic-led
We follow what your web and mobile apps actually call, which often reveals endpoints nobody documented.
Multi-tenant
With accounts in two tenants, we check that no data crosses the line between your customers.
From first call to clean exit
Every engagement follows the same five steps. Our penetration testing process page explains each one in detail.
- Day 0
Scoping call
A free call to understand what you want tested and why: the applications, networks or APIs, your deadlines and any compliance requirement behind the test. You get a written quote with the scope, timeline and deliverables set out.
- Before testing
NDA and rules of engagement
We sign a mutual NDA, or work under yours, then agree the rules of engagement: targets, testing windows, contacts, and anything that must not be touched. Testing can start within 48 hours of the scope being signed.
- Testing
Hands-on testing
Our testers combine tools with manual testing, following OWASP, PTES and NIST SP 800-115. If we confirm a critical issue, we tell you straight away instead of waiting for the report.
- Report
Report and walkthrough
Every finding is reproduced by a tester before it goes in the report, with severity, evidence and a fix written for your stack. We walk your team through the results and answer questions.
- After
Retest and clean exit
When you have fixed the issues, we can retest and issue an updated report. When the engagement ends, we remove test accounts, credentials and working files, and confirm it in writing on request.
Findings your developers can act on
Each finding explains what is wrong, what an attacker could do with it, and how to fix it in your stack. No raw scanner output, and nothing we have not reproduced ourselves.
Users of one organisation could list the users of another
- Affected area
- User directory API
- Impact
- Any signed-in user could see the names, emails and roles of people in other customer organisations by changing one value in the request.
- Fix
- Take the organisation from the caller's own session on the server, and refuse any request for a different one.
An illustrative example. Client names, systems and data are always kept confidential.
What we need from you
- The base address and environment
- An OpenAPI or GraphQL schema, or a Postman collection
- Credentials for each role, and for two separate tenants if your product is multi-tenant
- Rate limits to respect and any endpoints out of scope
What you receive
- Findings mapped to the OWASP API Security Top 10 (2023)
- Evidence for every issue
- Fixes at the endpoint and framework level
- A list of undocumented endpoints we found
Questions about api penetration testing
Do you test GraphQL as well as REST?
Yes. For GraphQL we also look at schema exposure, query depth and complexity limits, batching and field-level authorization.
What do you need from us to start?
A schema or collection helps a lot, plus credentials for each role. If you run a multi-tenant product, accounts in two separate tenants let us test the boundary between customers.
Can you test our API without a front end?
Yes. Many API tests have no user interface at all. We work directly with the endpoints.
Is API testing included in a web application test?
The APIs a web application calls are covered in our web application tests. A dedicated API test goes further: every endpoint, method and version, including partner and public APIs that no front end uses.
How long does an API penetration test take?
It depends on the number of endpoints and roles. A focused API with a few dozen endpoints usually takes about a week of testing. Your quote states the timeline.
Further reading
Guides from the Krylo Security blog.
API penetration testing: why web APIs need it
Read the guide ↗Penetration testing explained
Read the guide ↗AI in cybersecurity
Read the guide ↗Other penetration tests
Web application penetration testing
Customer portals, SaaS platforms, dashboards and online stores, tested by hand against the OWASP Top 10 and your business logic.
Mobile app penetration testing
iOS and Android apps tested on real devices against OWASP MASVS, together with the APIs and backend they depend on.
Network penetration testing
Your internet-facing perimeter and internal network, including Active Directory and cloud hosts, tested from outside and from within.
Start your security assessment.
Tell us about your application, architecture or compliance requirements. Our team will scope a penetration test around them.