There are several approaches and open source tools that can help to build your API security testing framework. The key challenge for security testing is the processing responses part. For example, to be able to identify the SQL injection vulnerability, the security testing requires not only proper designed injection payloads, but also the ability to identify the responses for SQL injection patterns. Therefore, when we build the security testing for restful or SOAP APIs, it's recommended that you apply the web security testing framework to help with the response detection.
To build the security API testing framework, we will introduce three levels of approaches as summarized in the following table:
|
Level |
Recommended toolkits |
Pros and cons |
|
Basic |
ZAP |
ZAP can provide a general web security baseline scan. However, ZAP... |