In this chapter, we discussed the security testing for API release. The API security testing involved the data input, the requests, and the analysis of the responses. For the data input parts, we suggested using FuzzDB and SecList. To send the API requests, we applied the OWASP ZAP and JMeter in our case studies. For the security analysis of API responses, we used OWASP ZAP.
Four hands-on case studies were demonstrated. They applied different techniques for the API security testing scenarios. In addition, we also demonstrated how the testing tool JMeter can be integrated with the security scanning tool ZAP to achieve the API security testing:
- Basic—web service testing with ZAP CLI
- Intermediate—API testing with ZAP and JMeter
- Advanced—parameterized security payload with fuzz
- Security testing with ZAP OpenAPI/SOAP API
After having discussed API-level...
