API testing
Application ProgrammingTesting
- APIs are a set of protocols that enables programs to communicate and exchange data.
- API testing also involves reverse engineering.
- Ethical Hackers are also involved to try to gain knowledge how the API works
- API testing ensures that:
- Authentication and authorization. are implemented
- Usage of SSL/TLS encryption.
- Use auditing and logging.
- Restriction of access to sensitive data.
- Monitor and alert on anomalous activity.
Examples of API hacking
- Stolen Authentication
Trying to access an API is to hijack the identity of an authorized user. e.g. steeling (Deep Dark Web is a good farm for such activities) authentication token can be used to access resources with malicious intent while appearing legitimate.
Cybercriminals will try to guess authentication passwords or break a weak authentication process to gain access.
- Man-in-the-Middle Attack
A man-in-the-middle (MITM) attack occurs when a malicious hacker intercepts a request or response between an end user and an API.
- Code Injections
Gaps in between authentication and validation APIs are vulnerable to code injections, in which an attacker sends a script to an application’s server via an API request.
- Denial-of-Service Attack
Is simply overwhelming server’s resources with API requests.