How do I test the security of my APIs?

You can test the security of your API by manually penetration testing. However, you can save a lot of time and money if you first use an automated vulnerability scanner. This way, your penetration testers will have much less work and can focus on the most challenging issues. Read how vulnerability scanning and penetration testing work together .

What security threats affect APIs?

Your API is susceptible to the same serious security threats that affect websites and web applications. Most web vulnerabilities can be just as severe for APIs. A critical vulnerability may let someone use your API to steal your sensitive data or attack others. Find out about potential consequences of an SQL Injection vulnerability .

How do I begin to scan my API?

To scan your API, you either need a web application front-end, formal definition files, or some other data that describes the structure of your API. Acunetix can either discover your API on its own, use a WADL or Swagger definition, or use data imported from other tools or files. Find out what import formats Acunetix supports .

How do I protect my API?

You cannot effectively protect your API with a web application firewall (WAF) – intruders may be able to circumvent it and problems will just keep piling up. You must regularly check for new vulnerabilities and eliminate them by correcting the source code of your API. The best way to do it is to integrate vulnerability scanning in your SDLC. Learn how to integrate Acunetix with Jenkins .

Web Security Blog | Page 37 of 139

REST API Security Testing with Acunetix

Web Security Zone | June 20, 2019 by Ian Muscat

Security vulnerabilities in RESTful APIs (Application Programming Interfaces) introduce the same risks as security issues in websites and other web applications: sensitive data theft, manipulation, and more. Therefore, it is very important to know how to test them efficiently. However, some characteristics of REST APIs…

Test Your XSS Skills Using Vulnerable Sites

Web Security Zone | June 18, 2019 by Tomasz Andrzej Nidecki

Finding and proving application security vulnerabilities requires a lot of skill. However, many of them are easy to exploit. If you want to write better code, you should know how others may prey on your mistakes. We compiled a Top-10 list of web applications that…

What Is a Buffer Overflow

Web Security Zone | June 17, 2019 by Tomasz Andrzej Nidecki

A buffer overflow vulnerability occurs when you give a program too much data. The excess data corrupts nearby space in memory and may alter other data. As a result, the program might report an error or behave differently. Such vulnerabilities are also called buffer overrun….

Authentication Bypass in WP Live Chat

Web Security Zone | June 13, 2019 by Tomasz Andrzej Nidecki

WP Live Chat for WordPress is a very popular plugin used by many companies to provide online support. Currently, it has more than 50000 active installations. Very recently, researchers from Alert Logic found an authentication bypass vulnerability in this plugin. This vulnerability may be used…

A Typo Can Make You an Administrator

Web Security Zone | June 11, 2019 by Tomasz Andrzej Nidecki

You are a developer. You put a lot of effort into making sure that your code is safe. You never trust user input, you use the best security-related development libraries. And then you make one small typo and everything is ruined. This is not fiction….

Protecting Your Website against Low Orbit Ion Cannon

Web Security Zone | June 10, 2019 by Tomasz Andrzej Nidecki

The Low Orbit Ion Cannon (LOIC) is a tool that was developed by Praetox Technologies as a network stress testing application and then released into the public domain. This application is available as open source on Sourceforge.net and often used by malicious parties for DoS…

Mitigate Slow HTTP GET/POST Vulnerabilities in the Apache HTTP Server

Web Security Zone | June 6, 2019 by Ian Muscat

A slow HTTP Denial of Service attack (DoS), otherwise referred to as the Slowloris HTTP attack, makes use of HTTP GET requests to occupy all available HTTP connections permitted by a web server. It takes advantage of a vulnerability in thread-based web servers, which wait…

Visit Us at Black Hat USA 2019

Events | June 4, 2019 by Oksana Pure

Black Hat, founded by Jeff Moss (Dark Tangent), is one of the biggest and best-known cybersecurity conferences in the world. Organized in the USA since 1997 and in Europe and Asia since 2000, it is perceived as aimed at the corporate world but it caters…

PHP Security Guide

Web Security Zone | May 30, 2019 by Tomasz Andrzej Nidecki

PHP remains the most popular server-side language for websites and web applications. According to the latest data from w3techs, it is used by 79% of websites whose server-side language is known. Therefore, secure PHP programming and configuration are of critical importance. There are more reasons,…

Acunetix Web Security Blog