API testing

• APIs are a set of protocols that enables programs to communicate and exchange data.
• API testing also involves reverse engineering.
• Ethical Hackers are also involved to try to gain knowledge how the API works
• API testing ensures that:
  •  Authentication and authorization. are implemented
  • Usage of  SSL/TLS encryption.
  • Use auditing and logging. 
  • Restriction of  access to sensitive data. 
  • Monitor and alert on anomalous activity.

• Stolen Authentication

Trying to  access an API is to hijack the identity of an authorized user. e.g. steeling (Deep Dark Web is a good farm for such activities) authentication token can be used to access resources with malicious intent while appearing legitimate.

Cybercriminals will try to guess authentication passwords or break a weak authentication process to gain access.

• Man-in-the-Middle Attack

A man-in-the-middle (MITM) attack occurs when a malicious hacker intercepts a request or response between an end user and an API.

• Code Injections

Gaps in between authentication and validation APIs are vulnerable to code injections, in which an attacker sends a script to an application’s server via an API request. 

• Denial-of-Service Attack

Is simply overwhelming  server’s resources with API requests.