Authorization-first API pentest.
REST, GraphQL and gRPC - tested against the full OWASP API Top 10, treating every JWT as if it were already compromised. Reproducible PoCs against your OpenAPI / GraphQL schema.
Threat landscape
What API attackers exploit first
The six attack classes that drive most modern API breaches. Authorization-first testing finds them before launch.
Cross-tenant breach via BOLA
One predictable object ID and one valid token - that's all an attacker needs to read another tenant's data.
JWT forgery / alg confusion
RS256 → HS256, `alg:none`, and `kid` injection still find their way into production tokens.
Rate-limit & resource abuse
Endpoints with no throttling become DoS amplifiers, password sprays and scraping pipelines.
Mass assignment escalation
PATCH /me {role: 'admin'} - still a working privilege-escalation vector in too many APIs.
GraphQL introspection leak
Introspection enabled in prod hands attackers your full schema, including internal-only types.
Shadow / undocumented APIs
v1, v2, /internal, /debug - the endpoints not in your OpenAPI spec are the ones attackers find first.
What we cover
- Authentication & token handling (JWT / OAuth)
- Authorization (BOLA / BFLA / IDOR)
- Input validation & mass assignment
- Rate limiting & abuse prevention
- Transport security & TLS configuration
- GraphQL specifics (depth, introspection, batching)
Common findings
- Broken object-level authorization (BOLA)
- Broken function-level authorization (BFLA)
- Excessive data exposure
- Mass assignment / parameter pollution
- Lack of rate-limiting / brute-force protection
- Improper inventory & shadow APIs
OWASP API Top 10 (2023)
Coverage matrix
Authorization gets two of the top five slots. We test it like an attacker does - exhaustively.
Authorization-first
Every JWT is suspect
The single highest-impact class of API bug. We don't just exercise the happy path with a valid token - we treat the token as a credential the attacker already has, and walk every endpoint.
- Object-level checks executed with every role pairing (admin → user, tenant-A → tenant-B)
- Function-level checks across all HTTP verbs - POST/PATCH/DELETE silently allowed?
- JWT introspection - algorithm confusion (RS256→HS256), `alg:none`, `kid` injection
- OAuth scope tests - PKCE, redirect-URI validation, refresh-token reuse
- GraphQL - query depth, introspection on/off in prod, mutation authorization
REST surface
OpenAPI / Swagger-driven enumeration. Every endpoint × every verb × every role pairing. Authorization matrix delivered as part of the report.
POST /api/v2/orders [admin] [member] [viewer] [other-tenant]
GET /api/v2/orders/:id [admin] [member] [viewer] [other-tenant]
PATCH /api/v2/orders/:id [admin] [member] [viewer] [other-tenant]
DELETE /api/v2/orders/:id [admin] [member] [viewer] [other-tenant]
↑
Each cell = expected vs observedGraphQL surface
Schema-aware testing. Introspection on/off, mutation authorization, batching abuse, query-depth DoS, alias attacks.
query AttackerProbe {
user(id: "1") { email role }
admin: user(id: "1") { email role internalNotes }
__schema { types { name } }
}Tools & stack
What's in the toolbox
See what a real report looks like
24 pages, redacted from a live engagement. Executive summary, technical findings with PoCs, remediation roadmap and attestation.
- Executive summary + technical report
- Reproducible PoCs with screenshots
- Remediation roadmap + retest plan
- Letter-of-attestation appendix
How we work
Methodology
A repeatable five-phase process. Same depth whether it's a focused spot test or a multi-surface engagement.
Recon & threat modeling
Asset discovery, app mapping, STRIDE/DREAD analysis to scope what matters.
Automated baseline
Tuned SAST/DAST/scanners to clear the noise. Never the primary signal.
Manual exploitation
Where the real findings live. Senior testers, real PoCs, chained attacks.
Risk assessment
CVSS scoring combined with your business context - not auto-generated severities.
Reporting
Executive summary + reproducible technical report + remediation roadmap.
Frameworks & standards
Mapped to the standards your auditors care about
Reports map findings to the frameworks your compliance team is already chasing. Drop-in evidence for ISO, SOC 2, PCI and DPDP audits.
FAQ
Common questions
If you're evaluating multiple firms, these are the questions worth asking each of us.
How long does a typical engagement take?
A focused spot test runs 5-7 business days. Multi-surface engagements typically take 2-4 weeks depending on application complexity. We agree on a written scope before the contract - no surprise extensions.
Is testing safe to run in production?
We test in production only when staging is unavailable and only with explicit written approval, an agreed test window, and a documented rollback plan. Destructive checks (DoS, data corruption) are excluded unless specifically requested.
What certifications does your team hold?
Engagements are run by senior testers and signed off by a practice lead. We test to recognised methodologies - OWASP, PTES and the OSSTMM - and map every finding to CVSS and CWE. If your procurement process needs specific individual credentials on file, we'll share them under NDA during scoping.
Do you offer retests after we patch?
Yes - retest engagements are scoped separately, focused only on the findings you've patched. Pricing is proportional to the surface area being re-verified and we send a written scope before any work starts.
What format are the deliverables in?
PDF reports (executive summary + technical), an editable findings spreadsheet, attack-path diagrams where relevant, and a letter of attestation on request. All findings include CVSS, CWE, repro steps, and remediation guidance.
How is scope determined and priced?
After a 15-minute discovery call we send a written scope inside 48 hours - fixed-price, with clearly itemized exclusions. No hourly billing surprises, no scope creep mid-engagement.
Lock down your API surface.
Send us your OpenAPI spec (or just a list of routes) and we'll come back with a scope in 48 hours.