API security testing

For API testing, we applied ZAP and JMeter with the FuzzDB security payloads. The ZAP itself can be used to send malicious APIs and also analyze the HTTP responses for the security issues. On the other hand, JMeter is mainly used to send the HTTP requests with FuzzDB security payloads by using CSV Config Element. Furthermore, there are also other approaches to do the fuzzing testing, such as Selenium with data-driven testing (DDT) module, Robot Framework with DDT, as well as Od1n and Wfuzz.

What are API security testing approaches?

The following table lists the API security testing tools and approaches:

Level	Recommended toolkits	Pros and cons
Basic	ZAP	ZAP can provide a general web security...