Authentication and Authorization Testing

Assuming you read the previous chapter or already have knowledge about Application Programming Interface (API) reconnaissance, it’s now time to dive deeper into pentesting the API. In the previous chapter, we worked through a crAPI challenge by accessing data from objects that belong to other users. This data was supposed to be protected, but crAPI didn’t do it correctly. This was an authorization flaw.

We need to investigate how APIs establish some of their most fundamental security mechanisms, which are how they authenticate and authorize their users. We will use the term AuthN to refer to authentication and AuthZ to refer to authorization just to shorten the words; this is a common practice in the literature. Weak AuthN mechanisms can usually be discovered during the initial stage of our work, which we covered in the previous chapter. After some interactions and analysis, we can discover the data structures an API applies...