🔒 OWASP API Security Training

A Professional Guide to Understanding and Securing APIs

📚 Introduction to APIs

What is an API?

API stands for Application Programming Interface. It is a set of protocols, tools, and definitions that allows two applications to communicate with each other. Think of it as a messenger that takes requests, tells a system what you want to do, and returns the response back to you.

When two applications need to communicate with each other, they use an API - an Application Programming Interface. This interface allows programs to interact with each other seamlessly. While APIs exist at different levels (operating system, library, database), this course focuses primarily on Web APIs as they represent the most common attack surface in modern applications.

⚠️ Security Consideration: Applications communicating through APIs often have an inherent trust relationship. This trust can be exploited, making APIs an increasingly important attack surface that needs proper security assessment.

🔧 Types of APIs

APIs come in various forms and architectures. Understanding the differences is crucial for effective security testing:

REST

Representational State Transfer - Uses HTTP methods and is stateless

SOAP

Simple Object Access Protocol - XML-based messaging protocol

GraphQL

Query language and architecture for APIs

Database APIs

Direct database communication interfaces

OS APIs

Operating system level interfaces

Library/Framework APIs

Programming library interfaces

Note: While REST and SOAP are often compared, they're fundamentally different - like comparing apples to bananas. REST is an architectural style, while SOAP is a protocol.

⚙️ How Web APIs Work

Important: From this point forward in the course, when we say "API," we're referring to Web APIs specifically.

Request-Response Model

Web APIs operate on a request-response model, similar to how your web browser communicates with websites. The communication uses standard HTTP methods that you're already familiar with.

API Communication Flow

Client Application

Sends Request

→
API Endpoint

Processes Request

→
Server

Executes Logic

→
Response

Returns Data

HTTP Methods Used in APIs

HTTP Method Purpose Example Use Case
GET Retrieve data Fetch user information
POST Create new data Submit a new user registration
PUT Update existing data Update user profile
DELETE Remove data Delete a user account
OPTIONS Check allowed methods Discover API capabilities
PATCH Partial update Update specific fields

💡 Example: API Request and Response

Request:

GET /api/users/123 HTTP/1.1
Host: example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Response:

HTTP/1.1 200 OK
Content-Type: application/json
{"id": 123, "name": "John Doe", "email": "[email protected]"}

Key Difference: In a web API, you as the developer can define which HTTP methods are allowed and which aren't. You also control what status codes are returned. For example, if a client submits an invalid string, you can return a 500 server error or any other appropriate status code.

🧩 Critical API Components

Understanding these components is essential for both developing and testing APIs:

Endpoints
Parameters
Headers
Payloads
Bodies

1. Endpoints

Endpoints are the specific URLs where API requests are sent. They define the location of resources.

Examples:
https://api.example.com/v1/users
https://api.example.com/v2/products
https://api.example.com/v3/orders/{id}
⚠️ Security Note: Pay close attention to version numbers in endpoints (v1, v2, v3). Different versions may have different security implementations, and older versions might contain vulnerabilities.

2. Parameters

Parameters are used to pass data to the API. They can appear in different locations:

  • Query Parameters: Appended to the URL after a question mark
  • Path Parameters: Embedded within the endpoint URL
  • Body Parameters: Sent in the request body (typically with POST/PUT)
Parameter Examples:
Query Parameter: /api/users?role=admin&status=active
Path Parameter: /api/users/123/posts/456
Body Parameter: {"username": "admin", "password": "secret123"}

3. Headers

Headers provide metadata about the request or response. Common headers include:

Header Purpose
Content-Type Specifies the media type of the resource
Authorization Contains credentials for authentication
Accept Specifies the media types the client can handle
User-Agent Identifies the client application

4. Payloads and Bodies

The payload (or body) contains the actual data being sent with the request. While the terms are often used interchangeably, the body specifically refers to the data portion of an HTTP message.

JSON Payload Example:
{
"username": "testuser",
"email": "[email protected]",
"password": "SecurePass123!",
"role": "user"
}

🔐 Authentication vs Authorization

Understanding the difference between these two concepts is fundamental to API security:

Authentication vs Authorization

Authentication

Who are you?

Verifying identity

≠
Authorization

What can you do?

Verifying permissions

Authentication

Authentication is the process of verifying who you are. When you authenticate, you're logging in and proving your identity to the system.

Example: Providing a username and password to log into a system.

Authorization

Authorization is the process of verifying what you're allowed to do. After authentication, authorization determines which resources and actions you have permission to access.

Example: Being logged in as a regular user, but not having permission to access admin features.

Real-World Scenario

Authentication: You show your ID card at the airport security checkpoint to prove you are who you say you are.

Authorization: Your boarding pass determines which flight you can board and which seat you can sit in.

Aspect Authentication Authorization
Question Answered Who are you? What can you do?
Process Login verification Permission checking
Occurs First (before authorization) After authentication
Methods Passwords, biometrics, tokens Roles, permissions, ACLs
Can Exist Without Authorization (yes) Authentication (no)

🧪 Lab Basics

Getting Started with API Testing

Throughout this course, we'll explore API security through hands-on labs. These labs will help you understand how APIs work in practice and how to identify security vulnerabilities.

Essential Tools for API Testing

  • Burp Suite: Intercepting and modifying API requests
  • Postman: Testing and documenting APIs
  • cURL: Command-line tool for making API requests
  • OWASP ZAP: Automated security testing

Basic API Testing Commands

Making a simple GET request:
curl -X GET "https://api.example.com/users" -H "Accept: application/json"
Making a POST request with data:
curl -X POST "https://api.example.com/users" -H "Content-Type: application/json" -d '{"username":"testuser","email":"[email protected]"}'
Making an authenticated request:
curl -X GET "https://api.example.com/admin/users" -H "Authorization: Bearer YOUR_TOKEN_HERE"
Testing different API versions:
curl -X GET "https://api.example.com/v1/users"
curl -X GET "https://api.example.com/v2/users"
curl -X GET "https://api.example.com/v3/users"
Checking allowed HTTP methods:
curl -X OPTIONS "https://api.example.com/users" -i
Viewing full request and response headers:
curl -X GET "https://api.example.com/users" -v
⚠️ Ethical Hacking Reminder: Always ensure you have proper authorization before testing any API. Only test APIs you own or have explicit written permission to test. Unauthorized API testing is illegal and unethical.

📝 Key Takeaways

  • APIs are Application Programming Interfaces that enable communication between applications
  • Web APIs are the primary focus due to their prevalence and attack surface
  • APIs operate on a request-response model using HTTP methods
  • Critical components to understand: Endpoints, Parameters, Headers, Payloads, and Bodies
  • Pay special attention to API versioning (v1, v2, v3) as they may have different security implementations
  • Authentication (who you are) is different from Authorization (what you can do)
  • APIs often have inherent trust relationships that can be exploited
  • Always practice ethical hacking with proper authorization

🎯 Next Steps

Now that you understand the fundamentals of APIs, you're ready to dive deeper into API security testing. The upcoming modules will cover:

  • Common API vulnerabilities (OWASP API Security Top 10)
  • Advanced authentication and authorization testing
  • API enumeration and reconnaissance techniques
  • Exploiting broken object level authorization
  • Mass assignment vulnerabilities
  • Security misconfiguration testing
  • And much more...

Remember: The basics covered here form the foundation for everything else. Make sure you're comfortable with these concepts before moving forward.