API Penetration Testing Services
At Trilight Security, we provide comprehensive API penetration testing services for organizations across the USA and the EU, including a strong focus on Germany. Our certified experts go far beyond automated scanning — manually mapping your full API attack surface, probing authorization logic at every endpoint, testing authentication mechanisms including OAuth 2.0 and JWT implementations, simulating business logic abuse scenarios, and uncovering shadow and zombie APIs that your team may not even know exist. Get in touch with Trilight Security to discover how our API pentesting services can protect your backend systems, secure the data your APIs expose, and demonstrate compliance with PCI-DSS, NIS2, GDPR, and other applicable regulations.
Shadow & Zombie API Discovery
Shadow APIs are undocumented endpoints created by expeditious teams or developers who forget to document them or leave them behind as legacy code during agile sprints — ticking time bombs for your organization. Zombie APIs are old API versions still running in production without monitoring or security controls. We systematically enumerate your full API estate — including undocumented endpoints, deprecated versions, staging APIs exposed to the internet, and third-party integrations — ensuring that nothing in your environment is assessed against documentation alone.
Multi-Protocol Expertise
REST, GraphQL, and gRPC have different attack surfaces — GraphQL is particularly vulnerable to denial-of-service through nested queries, and gRPC requires specialized tools. We test REST, GraphQL, gRPC, SOAP, and WebSocket APIs with protocol-specific attack techniques rather than generic scanner patterns. For GraphQL we use dedicated tooling including GraphQL Voyager and InQL for schema introspection, batching attacks, and field-level authorization bypass. For gRPC we use grpcurl and Evans to enumerate services and test authorization. For REST we apply the full OWASP API Security Top 10 (2023) across every endpoint, role, and object type.
Our Offering
Black Box Pentesting
We provide black box API penetration testing where we have no prior knowledge of the API’s internal architecture, documentation, or technology stack. We discover endpoints through active enumeration, traffic analysis, and OSINT — replicating the perspective of an external attacker who has found an API exposed to the internet with no insider access.
Grey Box Pentesting
For grey box pentests we use API docs (Swagger/OpenAPI specifications, Postman collections) and user-level credentials, but without access to source code or internal architecture info. This effective model for API security testing allows us to achieve full endpoint coverage and approach authorization and business logic from an adversarial perspective.
White Box Pentesting
We conduct white box pentests where we have full access to API source code, architecture docs, all credentials across every role and permission level, and CI/CD pipeline configuration. This approach enables the deepest assessment — combining static code review with active exploitation to surface vulnerabilities that neither approach alone would find.
Why API Penetration Testing?
APIs by design expose application logic and sensitive data directly — there is no HTML rendering layer, no browser-enforced same-origin policy, and no user interface sitting between an attacker and your backend. BOLA (Broken Object Level Authorization) accounts for over 40% of API vulnerabilities and requires testing every endpoint with different user contexts — something no automated scanner can do, because every request returns a valid 200 response and the scanner cannot know that the returned data belongs to a different user. A manual API penetration test goes beyond running a scanner — our experts forge JWT tokens, test OAuth code reuse, probe session invalidation, map multi-step workflow authorization, and chain multiple low-severity findings into critical attack paths that demonstrate real-world business impact. Regulations such as NIS2 and DORA impose additional requirements regarding API security testing frequency, and our assessments produce the documented evidence that auditors, enterprise customers, and regulators require.
For teams following agile or DevSecOps practices, we support recurring engagement models and can advise on integrating automated API security scanning into your CI/CD pipeline — ensuring new endpoints, updated authentication flows, or changed data models are assessed before they reach production
What We Test
OWASP API Security Top 10
Our assessments provide systematic coverage of all ten OWASP API Security Top 10 (2023) categories:
- API1:2023 — Broken Object Level Authorization (BOLA): Testing every endpoint that accepts an object identifier across all user contexts, tenants, and roles — the single most prevalent API vulnerability class
- API2:2023 — Broken Authentication: OAuth 2.0 flows, JWT implementation, API key security, session management, credential stuffing resistance, and authentication bypass
- API3:2023 — Broken Object Property Level Authorization: Probing for sensitive property exposure and mass assignment — testing whether the API exposes or accepts object properties that should be restricted for the requesting role
- API4:2023 — Unrestricted Resource Consumption: Rate limiting on all endpoints, pagination limits, file upload size restrictions, GraphQL query complexity limits, and resource exhaustion via bulk operations
- API5:2023 — Broken Function Level Authorization (BFLA): Administrative and privileged endpoint access testing with standard user credentials, HTTP method manipulation, and forced browsing to undocumented admin functions
- API6:2023 — Unrestricted Access to Sensitive Business Flows: Business logic abuse — automated scalping, referral farming, inventory manipulation, account creation abuse, and any flow exploitable at scale
- API7:2023 — Server-Side Request Forgery (SSRF): Out-of-band SSRF testing on all URL-accepting parameters, webhook handlers, file import functions, and third-party integration endpoints
- API8:2023 — Security Misconfiguration: CORS policy, HTTP security headers, TLS configuration, verbose error messages, exposed debug endpoints, and default credentials
- API9:2023 — Improper Inventory Management: Shadow API discovery, deprecated version enumeration, staging endpoint exposure, and documentation vs. reality discrepancy analysis
- API10:2023 — Unsafe Consumption of APIs: Webhook signature validation, third-party API response trust, certificate pinning for outbound calls, and supply chain API attack vectors
Protocol-Specific Coverage
- REST APIs — Full OWASP API Top 10, parameter fuzzing, HTTP method manipulation, versioning attacks
- GraphQL — Introspection abuse, schema extraction, batching/aliasing DoS, field-level BOLA, directive injection, query depth attacks
- gRPC — Service enumeration, method authorization, protobuf manipulation, reflection API exposure
- SOAP — XML injection, WSDL enumeration, WS-Security weaknesses, XXE via SOAP body
- WebSocket — Origin validation bypass, authentication on upgrade, message injection, authorization across message types
Penetration Testing Process
We use a combination of manual adversarial techniques and purpose-built automated tooling to assess API security. Our methodology is adapted to the specific API architecture, authentication model, and business context of each engagement. Typically, API penetration testing projects include the following stage:
- API Discovery & Attack Surface Mapping: We build a complete inventory of all in-scope API endpoints — including those present in documentation, those discovered through active enumeration and fuzzing, deprecated versions, and shadow endpoints not present in any specification. We map all parameters, HTTP methods, authentication requirements, and data types for each endpoint, and review any available OpenAPI/Swagger specifications or Postman collections for completeness and accuracy against the live API.
- Authentication & Session Management Testing: We test all authentication mechanisms in depth — including OAuth 2.0 authorization code flows, implicit and client credentials grant types, JWT signature verification and algorithm confusion attacks (including the
nonealgorithm bypass), API key entropy and scope restrictions, session token predictability, token refresh and revocation behaviour, logout invalidation, and credential stuffing resistance. We test for authentication bypass through parameter manipulation, HTTP method override, and version downgrade to unauthenticated legacy endpoints. - Authorization & Access Control Testing (BOLA/BFLA): Authorization testing is the highest-yield phase of any API engagement. We systematically test every endpoint that accepts object identifiers — attempting to access resources belonging to other users, other tenants, and other privilege levels by manipulating IDs, GUIDs, and reference parameters. We test function-level authorization by calling administrative and privileged endpoints with standard user credentials. We test object property-level authorization by probing whether the API exposes or accepts sensitive properties that should be filtered or read-only for the requesting role.
- Input Validation & Injection Testing: We test all input vectors for injection vulnerabilities — including SQL injection, NoSQL injection, command injection, LDAP injection, XML/XPATH injection, and Server-Side Template Injection (SSTI). We test for Server-Side Request Forgery (SSRF) on all URL-accepting parameters using out-of-band detection with Burp Collaborator. GraphQL-specific injection testing covers query depth attacks, alias-based batching, and directive injection. All exploitation is controlled and non-destructive.
- Business Logic & Rate Limiting Testing: Automated scanners cannot understand context — they cannot tell that your
/orders/{id}endpoint lets User A pull User B's order history just by changing an integer, and they cannot identify that a referral program API allows automated signup loops to farm credits. We manually probe the business logic of your API — including multi-step transaction flows, pricing and discount calculation endpoints, inventory reservation logic, payment processing workflows, and any function involving financial value or privileged operations. We test rate limiting on every endpoint, particularly authentication, enumeration-sensitive, and resource-intensive operations. ScienceSoft - API Inventory & Configuration Review: We assess the API's security configuration — including CORS policy, HTTP security headers, TLS/SSL configuration and cipher strength, error message verbosity, API versioning and deprecation management, and the exposure of debug endpoints, health-check routes, and internal metadata. We verify that the live API matches its documented specification and flag any undocumented endpoints, deprecated versions, or staging routes accessible from the internet.
- Third-Party & Webhook Integration Testing: We test the security of outbound API integrations and webhook implementations — including webhook signature validation, third-party API response trust assumptions, certificate pinning for outbound calls, and whether a compromised third-party service could be used to attack your system through its integration.
- Reporting: Our reports are thorough, developer-friendly, and structured to be useful for both technical teams and executive stakeholders. Each report includes:
-
- A detailed attack narrative for each finding, describing how the vulnerability could be exploited and what an attacker could achieve — with exact HTTP request and response evidence.
- Specific, prioritised remediation recommendations for every identified vulnerability, including code-level fix guidance where applicable, ordered by risk severity and exploitability.
- Compliance mapping to the OWASP API Security Top 10 (2023), OWASP WSTG, PCI-DSS, NIS2, GDPR, DORA, and other applicable frameworks.
Our Benefits
Top Certifications
Our experts have deep skills proven by years of success in demanding enterprise environments and top industry certifications including OSCE, OSCP, eWPTXv2, eWPT, BSCP (Burp Suite Certified Practitioner), CREST, CEH, and others.
Top Methodologies
OWASP API Security Top 10 (2023), OWASP Web Security Testing Guide (WSTG v4.2), PTES (Penetration Testing Execution Standard), NIST SP 800-115, and other penetration testing methodologies.
Rich Deliverables
We provide pentest reports with detailed findings, exact HTTP request/response evidence, attack narratives, prioritised remediation recommendations with code-level guidance, compliance mapping etc.
Cost Efficiency
One of our core advantages is access to top-tier cybersecurity and application security talent with extensive experience in demanding enterprise environments — delivered at transparent pricing.
Penetration Testing Methodologies
Our API penetration testing services follow the OWASP API Security Top 10 (2023) as the primary vulnerability taxonomy — the industry standard framework for API security assessment, covering the ten most critical and most commonly exploited API risk categories. The overall testing methodology follows the OWASP Web Security Testing Guide (WSTG v4.2), supplemented by API-specific testing techniques for REST, GraphQL, gRPC, SOAP, and WebSocket architectures. Engagement structure follows PTES (Penetration Testing Execution Standard), and technical documentation for compliance-driven engagements is aligned to NIST SP 800-115.
Findings are mapped to MITRE ATT&CK techniques where applicable. For compliance engagements, we align reporting to PCI-DSS requirements 6.2.3 and 11.3, NIS2 Article 21, ISO/IEC 27001, GDPR, HIPAA, DORA, and SOC 2 as required by the client.
Tools
Our experts tailor their toolset based on the engagement type — black box, grey box, or white box — and the specific API architecture of the target. Burp Suite Professional is the primary tool for all manual interception, request manipulation, active scanning, and out-of-band SSRF testing throughout every engagement, extended with the Autorize extension for automated authorization testing and InQL for GraphQL attack surface mapping. Automated vulnerability detection uses Nuclei with API-specific templates. API endpoint discovery and crawling uses Katana and ffuf. JWT testing uses jwt_tool and Hashcat for offline token cracking. GraphQL-specific testing uses GraphQL Voyager for schema visualisation and InQL for introspection and batch attack generation. gRPC testing uses grpcurl and Evans. TLS/SSL configuration is assessed with testssl.sh. All automated output is manually reviewed and validated — no finding is reported without human verification of exploitability and real-world impact.
Our Certifications
Deliverables
- Executive Summary: A high-level overview of the assessment results and overall risk exposure, written for management and non-technical stakeholders, including a clear statement of the most critical findings and their potential business impact.
- Test Plan: A document outlining the agreed scope, objectives, testing methodology, rules of engagement, and timeline for the engagement.
- Detailed Technical Report: A comprehensive report documenting all findings, including vulnerability descriptions aligned to the OWASP API Security Top 10 (2023) categories, CVSS risk ratings, step-by-step proof-of-concept exploitation walkthroughs with exact HTTP request and response captures, and prioritised remediation guidance — including code-level fix recommendations where applicable.
- API Inventory: A complete map of all API endpoints discovered during the engagement — including any shadow, zombie, or undocumented endpoints identified — with authentication requirements, data types, and risk ratings.
- Vulnerability Assessment: A full inventory of all vulnerabilities identified, including affected endpoints, parameter details, severity ratings, and exploitability assessment.
- Evidence: HTTP request and response captures, screenshots, and other supporting artefacts for all findings, providing reproducible documentation of every vulnerability.
- Compliance Mapping: A structured mapping of findings and remediation recommendations to OWASP API Security Top 10 (2023), PCI-DSS, NIS2, GDPR, ISO/IEC 27001, DORA, and SOC 2 as required.
- Action Plan: A structured remediation roadmap with recommended actions, suggested timelines, and responsible parties for each identified issue.
A presentation or briefing for relevant stakeholders — including a summary of findings, risk exposure, and recommended next steps — can be prepared upon request. After a follow-up retest to confirm that all identified vulnerabilities have been remediated, we issue a Pentest Certificate, which can be used for compliance audits, vendor due diligence, and customer communications.
Read more here:
About Web Application Penetration Testing
Penetration Test Report Sample
Penetration testing is a must for any business using digital services. We use different comprehensive tools, methodologies, and models for pentesting. DOWNLOAD our penetration test report sample and learn more.
FAQ
API penetration testing is a security assessment in which our experts simulate real-world attacks against your API endpoints — probing authentication, authorization, input handling, business logic, and configuration — to identify exploitable vulnerabilities before malicious actors do. Unlike automated scanning, manual API penetration testing can identify business logic flaws, authorization errors between user roles, and multi-step attack chains that no automated tool can detect.
Web application penetration testing assesses the full browser-facing application stack — including HTML rendering, client-side JavaScript, and the API layer. API penetration testing focuses exclusively and in greater depth on the programmatic interface layer — the endpoints, authentication mechanisms, authorization logic, and data structures that your API exposes. Where a web application pentest treats API testing as one component among many, a dedicated API pentest allocates the full engagement to achieving complete endpoint coverage, exhaustive authorization matrix testing, and protocol-specific attack techniques for REST, GraphQL, gRPC, and other API types.
We test REST, GraphQL, gRPC, SOAP, and WebSocket APIs. We assess both public-facing APIs and internal APIs, mobile app backends, third-party integration APIs, microservice-to-microservice APIs, and APIs serving IoT devices. We work with APIs documented in OpenAPI/Swagger, WSDL, or Postman collections, and can enumerate undocumented endpoints through active discovery when documentation is incomplete or unavailable.
BOLA — Broken Object Level Authorization — is the most prevalent API vulnerability class, holding the top position in the OWASP API Security Top 10 since 2019. It occurs when an API endpoint accepts an object identifier (such as a user ID, order number, or account reference) and returns the associated data without verifying that the requesting user is authorized to access that specific object. An attacker simply increments or modifies the identifier to access other users’ data. Automated scanners cannot detect BOLA because every request returns a valid HTTP 200 response — only a human tester who understands the application’s data ownership model can identify it. We test every endpoint that accepts an object identifier across all user contexts, tenants, and roles.
The OWASP API Security Top 10 is the industry-standard taxonomy for API security risk, published by the Open Web Application Security Project. The 2023 edition — the current active standard — identifies Broken Object Level Authorization (BOLA), Broken Authentication, Broken Object Property Level Authorization, Unrestricted Resource Consumption, Broken Function Level Authorization, Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery (SSRF), Security Misconfiguration, Improper Inventory Management, and Unsafe Consumption of APIs as the ten most critical API risk categories. Our assessments provide full coverage of all ten categories, supplemented by protocol-specific testing for GraphQL, gRPC, and WebSocket architectures.
Shadow APIs are undocumented endpoints that exist in production without appearing in any official specification — created during rapid development, left behind after feature changes, or inherited from third-party integrations. Zombie APIs are deprecated API versions that were never decommissioned and remain accessible, often without authentication or security controls applied to newer versions. Both represent significant attack surface that organizations are unaware of and therefore cannot protect. We discover shadow and zombie APIs through active endpoint fuzzing, path enumeration, JavaScript source analysis, subdomain scanning, version enumeration, and comparison of documented specifications against the live API’s actual behaviour.
Yes. GraphQL and gRPC require fundamentally different testing approaches from REST, and we apply protocol-specific tooling and attack techniques for both. For GraphQL we test introspection endpoint exposure, schema extraction, query depth and complexity attacks (nested query DoS), aliasing and batching attacks, field-level BOLA, directive injection, and authorization bypass via type confusion. For gRPC we use grpcurl and Evans to enumerate services and test function-level authorization, protobuf manipulation, and reflection API exposure.
We test all common API authentication mechanisms including OAuth 2.0 (all grant types — authorization code, implicit, client credentials, device code, and PKCE flows), JWT (including algorithm confusion attacks, the none algorithm bypass, weak secret brute-forcing, and claim manipulation), API keys (entropy, scope restrictions, rotation enforcement), session-based authentication, mutual TLS (mTLS), and HMAC-based request signing. We test for authentication bypass via HTTP method override, version downgrade to unauthenticated legacy endpoints, and missing authentication on internal API routes.
Our API penetration testing follows the OWASP API Security Top 10 (2023) and OWASP Web Security Testing Guide (WSTG v4.2) as the primary testing frameworks, with PTES providing overall engagement structure and NIST SP 800-115 for compliance documentation. For compliance-driven engagements, we align findings to PCI-DSS requirements 6.2.3 and 11.3, NIS2 Article 21, ISO/IEC 27001, GDPR, HIPAA, DORA, and SOC 2 as applicable.
Testing is conducted in a controlled manner within agreed rules of engagement. We strongly recommend testing against a staging or pre-production environment wherever possible. Where production testing is required, we avoid destructive operations, data modification, excessive load generation, and any actions that could affect real user data. We maintain ongoing communication throughout the engagement and can pause immediately if any concern arises.
Yes, and we strongly recommend early-stage testing. Authorization architecture flaws, insecure OAuth flow design, and missing rate limiting are significantly cheaper to remediate before an API is deployed than after. We can assess APIs from early beta and advise on secure design patterns for authentication, authorization, and data exposure controls before they are built into production systems.
Duration depends on the number of in-scope endpoints, the complexity of the authentication and authorization model, the number of user roles to test, the API protocols involved, and whether source code review is included. A typical engagement for a standard REST API ranges from three to ten business days. GraphQL APIs, APIs with complex multi-tenant authorization, or APIs with many distinct roles typically require additional time. We provide a detailed scoping estimate after reviewing your API documentation or endpoint inventory.
For grey box testing we require API documentation (OpenAPI/Swagger specification or Postman collection), the base URL and environment details, and credentials for each user role in scope. For black box testing we require only the base URL and a statement of authorisation. For white box testing we additionally require source code repository access. All information is handled in accordance with our ISO 27001-aligned security practices.
Yes. Our API penetration tests can be scoped and documented to satisfy requirements under PCI-DSS, GDPR, NIS2, HIPAA, DORA, ISO/IEC 27001, and SOC 2. API security is explicitly addressed in PCI-DSS Requirement 6.2.3 (application security testing) and NIS2 Article 21 (risk management measures). We provide compliance-mapped reporting that aligns findings and remediation guidance directly to the relevant control requirements.
Yes. Our team is available to consult on remediation efforts, clarify findings, review proposed fixes, and provide code-level guidance on secure API implementation. Once remediation is complete, we conduct a focused retest to confirm that all identified vulnerabilities have been effectively resolved before issuing the Pentest Certificate.
Pricing depends on the number of in-scope endpoints, the API protocols involved, the number of user roles and privilege levels, the depth of business logic testing required, and whether source code review is included. Engagements typically start from €1,500–2,000 for focused single-API assessments, scaling with complexity and scope. Given that a single BOLA vulnerability can expose an entire database of user records — as demonstrated in the Optus breach that affected millions of customers — a professional API penetration test represents a highly proportionate investment. Contact us for a detailed, obligation-free quote tailored to your API and compliance requirements.
Our Recognition
