Authentication and Authorization Testing
Assuming you read the previous chapter or already have knowledge about Application Programming Interface (API) reconnaissance, it’s now time to dive deeper into pentesting the API. In the previous chapter, we worked through a crAPI challenge by accessing data from objects that belong to other users. This data was supposed to be protected, but crAPI didn’t do it correctly. This was an authorization flaw.
We need to investigate how APIs establish some of their most fundamental security mechanisms, which are how they authenticate and authorize their users. We will use the term AuthN to refer to authentication and AuthZ to refer to authorization just to shorten the words; this is a common practice in the literature. Weak AuthN mechanisms can usually be discovered during the initial stage of our work, which we covered in the previous chapter. After some interactions and analysis, we can discover the data structures an API applies and then spot weak AuthZ controls.
In this chapter, you will learn about both topics in more depth, not only analyzing how they are presented by APIs but also understanding best practices for configuring and implementing them to protect the app environment. Weak or poorly implemented AuthN and/or AuthZ guardrails can compromise the whole application, not just the API.
In this chapter, we’re going to cover the following main topics:
- Examining authentication mechanisms
- Testing for weak credentials and default accounts
- Exploring authorization mechanisms
- Bypassing access controls
