Skip to main content
APIs account for the majority of modern data breaches. Snapsec conducts automated API penetration testing based on the OWASP API Security Top 10.

​
Coverage Areas

  • BOLA / IDOR (API1:2023): Object-level authorization bypasses across endpoint parameters.
  • Broken Authentication (API2:2023): Weak JWT validation, token replay, missing rate limits on password resets.
  • Unrestricted Resource Consumption (API4:2023): Denial of service via complex GraphQL nested queries or payload bombs.
  • Server-Side Request Forgery (API7:2023): Exploiting webhook endpoints to query internal cloud metadata.