You're reading from Pentesting APIs A practical guide to discovering, fingerprinting, and exploiting APIs

Product type Paperback

Published in Sep 2024

Publisher Packt

ISBN-13 9781837633166

Length 290 pages

Edition 1st Edition

Concepts

Cybersecurity

Author (1):

Maurício Harley

View More author details

Table of Contents (18) Chapters

Preface

1. Part 1: Introduction to API Security

2. Chapter 1: Understanding APIs and their Security Landscape FREE CHAPTER

3. Chapter 2: Setting Up the Penetration Testing Environment

4. Part 2: API Information Gathering and AuthN/AuthZ Testing

5. Chapter 3: API Reconnaissance and Information Gathering

6. Chapter 4: Authentication and Authorization Testing

7. Part 3: API Basic Attacks

8. Chapter 5: Injection Attacks and Validation Testing

9. Chapter 6: Error Handling and Exception Testing

10. Chapter 7: Denial of Service and Rate-Limiting Testing

11. Part 4: API Advanced Topics

12. Chapter 8: Data Exposure and Sensitive Information Leakage

13. Chapter 9: API Abuse and Business Logic Testing

14. Part 5: API Security Best Practices

15. Chapter 10: Secure Coding Practices for APIs

16. Index

Why subscribe?

17. Other Books You May Enjoy

Fuzzing for exception handling vulnerabilities

In Chapter 4, you quickly experimented with fuzzing by taking part in the exercises that we conducted with Burp Suite. Now, we are going to dive deeper into this technique. Fuzzing is very important in the context of API pentesting since it can expose an application’s vulnerabilities and weaknesses when incorrectly handling unexpected input. The types of vulnerabilities that can be raised from such bad handling may vary from information disclosure to denial-of-service (DoS).

A popular approach to fuzzing for exception handling vulnerabilities involves utilizing automated tools such as American Fuzzy Lop (AFL). AFL, created by Michal Zalewski and nowadays maintained by Google, is very good at creating random patterns to provide as input when testing API endpoints or apps. It operates by repeatedly modifying input files and monitoring the target application for crashes or unusual behavior. There are some good fuzzers out there...