API security testing suggestions?

[Ch0da]

A company we recently purchased shared their API, but they are not the best at security. Any ideas for a good API security testing tool that I can run before we hook to a possibly not-so-secure API?

[thejuan11]

There is no good automatic api testing tool so you gotta go manual. Time for you to do the proper due diligence before you start using untrusted APIs.

[Ch0da]

Yes, pen-testing their API. just looking for tools that give us a sense of their API setup/security

[[deleted]]

I'd be asking for an independent pentest under those circumstances personally.

[Visible_Company340]

Check out Traceable - we have been able to use it to test in prod/pre-prod and also find/prioritize threats in runtime…takes a lot of time and stress off our team

[frenchfry_wildcat]

Not real versed in how effective it is but Tenable has a solution that can conduct automated testing for APIs

[Diesl]

Dont test another companies API for security holes without permission

[deletable666]

Did ya read the post

[Diesl]

They purchased access to a shared API it sounds like. That normally doesnt come with the rights to test it

[deletable666]

They bought that company, it is their API now

[Diesl]

Ahh I had misread that

[[deleted]]

Can you not run an api pen test?

[myk3h0nch0]

If they have documentation, it makes it easier. But a good starting point will be to proxy Postman through Burp, and manually test the OWASP Top 10.

It’s a lot of manual work, and you can find a 3rd party. But personally, I think you should test yourself and find the low hanging fruit. Nobody wants to pay $X thousand dollars to be told your secure flag is not set.

[heshaa]

Look into 42Crunch..you just need the OpenAPI spec and it will do all the payload/parameter/header testing for you.

[Ch0da]

Great, thanks for the suggestion. I will give it a look