Object-level authorization
Whether one user can read or change another user’s records.
Services
API penetration testing
REST and GraphQL testing focused on authorization, the most common place for an API to give away more than it should.
Scope
What gets tested.
01
02
Function-level authorization
Administrative and internal actions reachable by ordinary users.
03
Tokens and JWT
Signature validation, key handling, audience and token lifetime.
04
Mass assignment
Fields the client can set but should never control.
05
Undocumented routes
Old versions, debug routes and endpoints missing from the documentation.
06
Limits and resource use
Missing rate limits and requests that cost far more than they should.
07
Injection
Query, command and template injection through API parameters.
08
GraphQL specifics
Field-level authorization, batching and exposed schema details.
Good fit
- Before a launch or major release
- After a significant architecture change
- When a customer asks for an independent test
- Before security due diligence
Included
What you receive.
- 01
Executive summary
Overall risk and priorities in plain language, for people who will not read the technical detail.
- 02
Technical findings
Severity, affected component, business impact, evidence, steps to reproduce and a specific fix for each issue.
- 03
Early notice
Critical issues are shared as soon as they are confirmed, without waiting for the final report.
- 04
One round of retesting
After your fixes, each finding is tested again and its status is updated in the report.
- 05
Attestation letter
A short letter stating what was tested and when, which you can share with customers or auditors.
Process
How the engagement runs.
- 1ScopeYou describe what to test. Targets, roles and timing are agreed, and you receive a written quote.
- 2AuthorizeThe system’s owner signs written authorization and rules of engagement. Testing does not begin without them.
- 3TestHands-on testing inside the agreed window. A critical issue is reported as soon as it is confirmed.
- 4ReportEvery finding comes with severity, business impact, evidence and a specific fix.
- 5RetestOnce you have fixed the issues, they are tested again and the report is updated with the results.
Questions
Common questions.
What do you need to test an API?
An OpenAPI or GraphQL schema or a Postman collection if you have one, credentials for each role, and a stable environment to test against.
Can you test an API with no documentation?
Yes, by working from a client that uses it. Documentation makes coverage more complete, so anything missing is noted in the report.
Find it before someone else does.
Tell ZeroDay Labs what you need tested. You will get a clear scope and a written quote before any work begins.
Request a pentest