Skip to content

API Testing Tasklist — OWASP API Top 10

API1:2023 — Broken Object Level Authorization (BOLA)

  • Enumerate all object IDs that appear in requests (UUIDs, integers, hashes)
  • Swap your own object IDs for those of other users (horizontal escalation)
  • Test with multiple accounts: create an object with account A, access it via account B
  • Check every HTTP method: GET sometimes doesn't work but PUT/DELETE does
  • Verify whether the server only filters based on a token or also actually checks ownership

API2:2023 — Broken Authentication

  • Test for weak / predictable tokens (JWT without signature check, UUID v1)
  • Try JWT algorithm confusion: alg: none, HS256 with the public key as the secret
  • Check token expiry — is an expired token rejected?
  • Test brute force on login endpoints (is rate limiting present?)
  • Check whether refresh tokens are invalidated after logout
  • Test credential stuffing on /login, /token, /oauth/token
  • Look for API keys in responses, headers or JavaScript files

API3:2023 — Broken Object Property Level Authorization (BOPLA)

  • Send extra fields in POST/PUT requests that you shouldn't be allowed to set (mass assignment): "role": "admin", "isVerified": true
  • Check whether the response returns more fields than needed (excessive data exposure): password hashes, internal IDs, PII of other users
  • Compare the response for a regular user vs an admin for the same object
  • Fuzz the request body with extra properties and observe the behavior

API4:2023 — Unrestricted Resource Consumption

  • Test rate limiting on all heavy endpoints (search, export, file upload, OTP)
  • Send large payloads to stress memory/CPU
  • Test GraphQL for query depth / complexity limits
  • Check whether batch requests are unbounded (e.g. /users?ids=1,2,3,...,10000)
  • Verify whether file uploads are limited in size and type
  • Test regex-based input for ReDoS possibilities

API5:2023 — Broken Function Level Authorization (BFLA)

  • Discover admin/internal endpoints via wordlists (ffuf, feroxbuster): /admin/, /internal/, /manage/
  • Test whether regular users can invoke admin functions just by knowing the URL
  • Swap HTTP methods: the endpoint accepts GET, but what about POST/DELETE/PUT?
  • Check whether there's a difference in authorization between v1 and v2 of the same API
  • Test privileged actions that are only blocked via the UI but not at the API level

API6:2023 — Unrestricted Access to Sensitive Business Flows

  • Identify critical business flows: checkout, registration, password reset, OTP
  • Test whether flows can be executed out of order (step 3 before step 1)
  • Check whether purchases/actions can be automated without CAPTCHA or device fingerprinting
  • Test for race conditions on limited resources (discount codes, vouchers, limited stock)
  • Verify whether temporary tokens (OTP, reset links) are reusable

API7:2023 — Server Side Request Forgery (SSRF)

  • Find all endpoints that accept a URL as input (webhooks, import, fetch, preview)
  • Test with internally reachable addresses:
    • http://169.254.169.254/ (AWS metadata)
    • http://localhost/
    • http://192.168.x.x/
  • Try DNS rebinding and alternative encodings: http://0x7f000001/, http://[::1]/
  • Test whether the response leaks information about the internal network (ports, services)
  • Check whether the server makes outbound DNS queries (use interactsh/Burp Collaborator)

API8:2023 — Security Misconfiguration

  • Check CORS: does the API accept Origin: null or Origin: evil.com?
  • Look for unnecessary HTTP methods (OPTIONS, TRACE)
  • Check security headers: X-Content-Type-Options, X-Frame-Options, CSP, HSTS
  • Look for debug endpoints, Swagger/OpenAPI specs, /api-docs, /graphql playground
  • Check whether stack traces or internal paths are visible in error responses
  • Test the TLS configuration: outdated cipher suites, is TLS 1.0/1.1 still active?
  • Check for default credentials on management interfaces

API9:2023 — Improper Inventory Management

  • Map out every version of the API: v1, v2, v3, beta, legacy
  • Test whether older versions are less strictly secured (no auth, no rate limiting)
  • Look for shadow APIs via JS bundles, mobile app decompilation or old documentation
  • Check whether deprecated endpoints are still active and reachable
  • Verify whether test/staging endpoints are publicly reachable in production

API10:2023 — Unsafe Consumption of APIs

  • Identify all third-party APIs the application consumes
  • Check whether the application validates responses from external APIs before processing
  • Test for injection via data coming from external sources (stored XSS, SQLi via third-party data)
  • Check whether SSL certificates of external APIs are validated
  • Test whether a compromised upstream API can cause a cascade effect (e.g. SSRF via a third party's webhook)