The Ultimate Guide to API Penetration Testing: OWASP Top 10, BOLA, BLA & Exploit Chains

The Ultimate Guide to API Penetration Testing: OWASP Top 10, BOLA, BLA & Exploit Chains

Modern web architecture has shifted decisively toward decoupled frontend applications, mobile frontends, and microservice mesh frameworks communicating exclusively via RESTful, GraphQL, and gRPC APIs. As business logic migrates from server-side rendered pages to backend API endpoints, the attack surface of web applications has expanded exponentially.

This definitive guide provides cybersecurity researchers, penetration testers, and application security engineers with an end-to-end operational methodology for scoping, enumerating, exploiting, and remediating API vulnerabilities in modern infrastructure.

Table of Contents

1. Understanding the Modern API Attack Surface
2. API Reconnaissance & Endpoint Discovery
3. Deep Dive into OWASP API Security Top 10
   • API1:2023 - Broken Object Level Authorization (BOLA)
   • API2:2023 - Broken Authentication
   • API3:2023 - Broken Object Property Level Authorization (Mass Assignment)
   • API4:2023 - Unrestricted Resource Consumption (Rate Limiting Flaws)
   • API5:2023 - Broken Function Level Authorization (BFLA)
4. GraphQL Security & Introspection Exploitation
5. Automating API Vulnerability Scanning with Burp Suite, Nuclei & Postman
6. Remediation & Defense-in-Depth Architecture

1. Understanding the Modern API Attack Surface

Unlike legacy monolithic applications where authorization checks are enforced visually across server-rendered views, APIs rely on stateless authentication tokens (JWTs, OAuth 2.0 Bearer tokens, API Keys) and client-supplied parameters. Attackers manipulate request headers, HTTP verbs (GET, POST, PUT, PATCH, DELETE), and payload parameters to bypass authorization checks.

Key Characteristics of Vulnerable API Environments:

• Stateless Session Tokens: Over-reliance on client-side JWT claims without server-side validation.
• Shadow APIs: Undocumented v1 or staging endpoints left accessible in production environments (/api/v1/user vs /api/v2/user).
• Excessive Data Exposure: Endpoints returning complete database records while relying on client-side JS frameworks (React/Vue/Angular) to filter fields.

2. API Reconnaissance & Endpoint Discovery

Effective API testing begins with thorough reconnaissance. Penetration testers must discover both documented endpoints (OpenAPI/Swagger) and hidden or legacy routes.

2.1 Passive Endpoint Enumeration

Search public source code repositories, JavaScript bundles, and Wayback archives:

# Extracting API endpoints from JavaScript files using LinkFinder
python3 linkfinder.py -i https://target.com/static/js/main.js -o cli

# Searching historical endpoint routes via gau (GetAllUrls)
gau target.com | grep -E '\.(json|api|v1|v2)' | tee api_endpoints.txt

2.2 Active Content Discovery & Wordlist Fuzzing

Fuzzing API paths using ffuf or Kiterunner (purpose-built API route discovery tool):

# Running Kiterunner against target API hosts using routes wordlist
kr scan https://api.target.com/ -w routes-large.kite -x 20 --ignore-length 0

# Fuzzing API parameters with ffuf
ffuf -u https://api.target.com/v1/users/101?FUZZ=1 -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -mc 200,403

3. Deep Dive into OWASP API Security Top 10

API1:2023 - Broken Object Level Authorization (BOLA)

BOLA occurs when an API endpoint exposes an object identifier (e.g., /api/orders/10045) without properly validating whether the authenticated user owns that specific resource.

Exploit Scenario:

1. User A (Attacker, User ID 8841) authenticates and captures request:

   GET /api/v2/invoices/9901 HTTP/1.1
   Host: api.target.com
   Authorization: Bearer eyJhbGciOi...
   

2. Attacker modifies the invoice ID parameter to target User B's resource (9902):

   GET /api/v2/invoices/9902 HTTP/1.1
   Host: api.target.com
   Authorization: Bearer eyJhbGciOi... (Attacker's token)
   

3. If the server responds with 200 OK and outputs User B's invoice details, a critical BOLA vulnerability exists.

API2:2023 - Broken Authentication

Weaknesses in credential validation, JWT signature verification, or password reset flows allow account takeover.

JWT Null Signature & Algorithm Confusion:

// Modifying header algorithm to 'none' or converting RS256 to HS256 using public key
{
  "alg": "none",
  "typ": "JWT"
}

# Using PyJWT to forge unverified claims
python3 -c "import jwt; print(jwt.encode({'user_id': 1, 'role': 'admin'}, '', algorithm='none'))"

API3:2023 - Broken Object Property Level Authorization (Mass Assignment)

Occurs when an API endpoint automatically binds client-provided HTTP request JSON fields directly to internal backend database models without filtering prohibited properties.

Exploit Scenario:

An attacker registers an account sending:

POST /api/v1/users/register HTTP/1.1
Content-Type: application/json

{
  "username": "attacker",
  "email": "attacker@target.com",
  "password": "Password123!",
  "is_admin": true,
  "role": "SuperAdmin",
  "account_balance": 999999
}

If the ORM (Prisma, Sequelize, Hibernate) persists is_admin: true to the database, elevated permissions are achieved instantaneously.

4. GraphQL Security & Introspection Exploitation

GraphQL APIs present unique security challenges due to single-endpoint structure (POST /graphql) and flexible query languages.

Introspection Query Extraction

Introspection allows attackers to map the entire GraphQL schema, including hidden queries, mutations, and fields:

# Full Introspection Query
query IntrospectionQuery {
  __schema {
    queryType { name }
    mutationType { name }
    types {
      name
      fields {
        name
        args { name type { name kind } }
      }
    }
  }
}

Disabling Introspection & Batching Attacks

If introspection is enabled in production, tools like InQL (Burp Extension) or GraphQLmap automatically generate executable mutation templates for every exposed parameter.

5. Automating API Vulnerability Scanning

Integrating automated templates accelerates vulnerability identification across large API surfaces:

# Scanning API targets with Nuclei API templates
nuclei -u https://api.target.com/ -t vulnerabilities/owasp-top10/ -t cves/ -t misconfiguration/

# Automated Postman Collection scanning via Newman & Burp proxy
newman run collection.json --ignore-redirects --insecure --proxy http://127.0.0.1:8080

6. Remediation & Defense-in-Depth Architecture

To secure enterprise APIs against authorization and mass assignment attacks:

1. Context-Aware Object Authorization: Implement fine-grained RBAC/ABAC checks at the controller level:

   # Example Python FastAPI Policy Enforcement
   @app.get("/api/v1/invoices/{invoice_id}")
   async def get_invoice(invoice_id: int, current_user: User = Depends(get_current_user)):
       invoice = db.find_invoice(invoice_id)
       if invoice.owner_id != current_user.id and not current_user.is_admin:
           raise HTTPException(status_code=403, detail="Access Denied")
       return invoice
   

2. Strict DTO Mapping: Use Data Transfer Objects (DTOs) and explicit schema validators (Pydantic, Zod) to reject unexpected JSON body parameters.
3. Enforce Rate Limiting & Web Application Firewalls (WAF): Enforce strict IP and token-based rate limits (e.g., 100 req/min) using API Gateways (Kong, NGINX, Cloudflare).

Authored by Syed Zada Abrar — Founder & Lead Security Researcher, Andrax Pentester.