Skip to content
Penetration testing
  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation
Security assurance
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
Managed security
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring
All services on one page
Industries How we work About Blog
1300 AURIAN Contact
Menu
Penetration testing
  • Penetration testing services
  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation
Security assurance
  • Security assurance and compliance services
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
Managed security
  • Managed security services
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring
  • All services
  • Industries
  • How we work
  • About
  • Blog
Call 1300 AURIAN Contact
  1. Services
  2. Penetration testing
  3. API penetration testing

Penetration testing

API penetration testing

We test the interfaces other software calls, where authorisation is per-object, per-function and easy to get wrong.

Scope a test Call 1300 AURIAN

Who this is for

  • Your product is an API, or depends on one

    A mobile app, a partner integration or a single-page application all sit on an API, and that API is the real attack surface.

  • You have had a web test but never an API test

    A browser test rarely exercises every endpoint or every method. Undocumented and deprecated endpoints often remain exposed and untested.

  • Partners or customers integrate directly with you

    When other organisations hold tokens to your API, a single authorisation flaw can expose one tenant's data to another.

What our API penetration test covers

Internet Web application API Perimeter Cloud tenancy Email Office network Workstation Identity Wireless Crown jewels Servers INTERNET: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. WEB APPLICATION: NOT IN SCOPE HERE Covered by web application penetration testing. Click to open that service. API: CHECKS INCLUDE Object and function level authorisation Mass assignment and schema abuse Rate limiting, token handling and key exposure Inventory of undocumented and legacy endpoints PERIMETER: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. CLOUD TENANCY: NOT IN SCOPE HERE Covered by cloud security assessment. Click to open that service. EMAIL: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. OFFICE NETWORK: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WORKSTATION: NOT IN SCOPE HERE Covered by essential Eight assessment. Click to open that service. IDENTITY: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WIRELESS: NOT IN SCOPE HERE Covered by wireless penetration testing. Click to open that service. CROWN JEWELS: CHECKS INCLUDE Customer records reachable through the API Bulk data exposure through enumeration SERVERS: NOT IN SCOPE HERE Covered by configuration review and benchmarking. Click to open that service. Internet Web application Perimeter API Email Cloud tenancy Office network Workstation Wireless Identity Crown jewels Servers INTERNET: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. WEB APPLICATION: NOT IN SCOPE HERE Covered by web application penetration testing. Click to open that service. PERIMETER: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. API: CHECKS INCLUDE Object and function level authorisation Mass assignment and schema abuse Rate limiting, token handling and key exposure Inventory of undocumented and legacy endpoints EMAIL: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. CLOUD TENANCY: NOT IN SCOPE HERE Covered by cloud security assessment. Click to open that service. OFFICE NETWORK: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WORKSTATION: NOT IN SCOPE HERE Covered by essential Eight assessment. Click to open that service. WIRELESS: NOT IN SCOPE HERE Covered by wireless penetration testing. Click to open that service. IDENTITY: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. CROWN JEWELS: CHECKS INCLUDE Customer records reachable through the API Bulk data exposure through enumeration SERVERS: NOT IN SCOPE HERE Covered by configuration review and benchmarking. Click to open that service.

We test the API against the OWASP API Security Top 10, across every documented endpoint and the undocumented ones we discover, in each role and tenant.

  • Broken object level authorisation, the most common and damaging API flaw
  • Broken function level authorisation, where a role reaches methods it should not
  • Broken authentication and token handling, including expiry, scope and revocation
  • Mass assignment, where a request sets fields it should not be allowed to set
  • Excessive data exposure, where an endpoint returns more than the client needs
  • Rate limiting and resource consumption, including enumeration and brute force
  • Injection and schema abuse, including GraphQL introspection and query depth
  • An inventory of undocumented, deprecated and shadow endpoints

How we test it

APIs fail differently from the applications in front of them. A browser application funnels every user through pages that enforce order and role; an API exposes each operation directly, to anything holding a token, in any sequence. That is why the OWASP API Security Top 10 is dominated by authorisation flaws, and why an Aurian API penetration test is built around testing authorisation on every endpoint, in every role, and across every tenant, by hand.

We start by building the real inventory of endpoints, from your specification, from captured traffic and from discovery, because the endpoints an organisation has forgotten are the ones nobody has secured. A senior consultant then works through the OWASP API categories against each endpoint: object-level and function-level authorisation, mass assignment, excessive data exposure, token handling, and rate limiting. Tooling helps us fuzz inputs and widen coverage, but the judgement about what a given field or endpoint should allow is the consultant’s.

For multi-tenant products we test the boundary between tenants explicitly, holding accounts in two tenants and trying to reach one from the other, because a single broken object-level check there exposes every customer to every other. Findings come with the exact request that reproduces them, so your developers can confirm the issue and know when it is closed, and we retest the findings rated high or above once you have remediated.

Standards OWASP API Security Top 10, OWASP ASVS

  1. 01 Inventory

    We build the real list of endpoints from your specification, your traffic and discovery, because the endpoints you forgot are the ones at risk.

  2. 02 Authorisation testing

    We test every endpoint across roles and, for multi-tenant systems, across tenants, because object-level authorisation is where APIs fail most.

  3. 03 Manual exploitation

    A consultant tests each category by hand, confirms real issues and chains them, with tooling used to fuzz and to widen coverage.

  4. 04 Reporting and retest

    You receive findings ranked by severity with the exact requests to reproduce them. Once you have remediated, a retest of the findings rated high or above confirms what is closed and the report is updated. Retesting is quoted with the test or booked afterwards.

What you receive

Every finding in an Aurian report looks like this: what we found, the evidence, what it means for you, and what to change.

Extreme AUR-2026-014 Sample finding, fictional environment

Mass assignment lets a user grant themselves administrative role

Affected asset
PATCH /api/v1/users/self on api.example.com.au
Rating
Extreme Likely 4 × Severe 5 = 20

Description

The profile update endpoint binds the whole request body to the user object without a field allow-list. By adding a role field to an otherwise ordinary update, a standard user can set their own account to administrator.

Evidence

PATCH /api/v1/users/self HTTP/1.1
Host: api.example.com.au
Authorization: Bearer eyJhbGciOi...   # a standard user's token
Content-Type: application/json

{ "displayName":"Jo Tan", "role":"admin" }

HTTP/1.1 200 OK
{ "id":8831, "displayName":"Jo Tan", "role":"admin" }

A standard user updated their display name and, in the same request, escalated their own role to administrator.

Impact

Any registered user can become an administrator with a single request, then read and change every other account and record. Mass assignment is invisible to a scanner because the request is valid; only a consultant testing each field against the data model finds it.

Remediation

Bind requests to an explicit allow-list of fields the client is permitted to set, and never to the full object. Set privileged fields such as role only through a separate, authorised administrative flow, and reject unexpected fields rather than ignoring them silently.

References

  • OWASP API Security Top 10, broken object property level authorisation
  • OWASP WSTG, testing for mass assignment
  • Executive summary written for the board and the insurer, in plain language
  • Technical findings ranked by severity, each with the request that reproduces it
  • An inventory of the endpoints tested, including any undocumented ones found
  • Remediation guidance your developers can act on without calling us

Common findings

What this kind of engagement typically surfaces, so you can recognise your own environment.

  • Broken object level authorisation

    Endpoints that return or change a record by its identifier without checking it belongs to the caller, exposing other users' or tenants' data.

  • Broken function level authorisation

    Administrative methods reachable by ordinary roles because the check sits in the client, not the server.

  • Mass assignment

    Requests that can set fields the client should never control, such as role, balance or ownership.

  • Excessive data exposure

    Endpoints that return whole objects and rely on the client to hide the sensitive fields, which an attacker simply reads from the response.

  • Missing rate limiting

    Endpoints that allow unlimited attempts, enabling enumeration of users, brute force of codes, and resource exhaustion.

  • Undocumented and deprecated endpoints

    Old versions and internal endpoints still live and still trusted, outside the scope of any prior testing.

Frequently asked questions

Why is a web application test not enough?

A browser test exercises the endpoints the interface happens to call, in the order it calls them. It rarely covers every method, every version, or the endpoints no page uses any more. An API test works from the full inventory and tests authorisation on each one directly.

Do you test GraphQL and SOAP as well as REST?

Yes. GraphQL brings its own concerns, such as introspection exposure and query-depth abuse, and SOAP has its own patterns. We adapt the methodology to the style your API uses.

What do you need from us?

The API specification if you have one, such as an OpenAPI or GraphQL schema, accounts or tokens in each role, and for multi-tenant systems, accounts in at least two tenants so we can test the boundary between them.

Can you test without documentation?

Yes. We can discover endpoints from application traffic and from the client, though a specification makes the test faster and more complete. We note any endpoints we find that were not in the documentation.

How long does it take?

It depends on the number of endpoints and roles: typically three to eight days of testing, with the report following. We confirm the timeframe after scoping.

Related services

Web application penetration testing

Web application penetration testing against the OWASP Testing Guide: authentication, access control, injection and business logic, tested by hand.

Mobile application penetration testing

Mobile application penetration testing for iOS and Android against OWASP MASVS: local storage, transport security, reverse engineering and the API.

Cloud security assessment

Cloud security assessment for AWS, Azure, Microsoft 365 and Google Cloud: CIS Benchmark review and attack-path testing of identity, exposure and logging.

Penetration testing services

Scope a test with a senior consultant

Tell us what you need to know about your environment. We reply within one business day.

Scope a test Call 1300 AURIAN

Aurian Security is an Australian penetration testing and security assurance firm. Senior consultants perform every engagement, for clients across the country.

Penetration testing

  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation

Assurance and managed

  • Security assurance
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
  • Managed security
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring

Company

  • About Aurian
  • How we work
  • Industries
  • Blog
  • Contact
  • Privacy policy
526/368 Sussex St, Sydney NSW 2000 1300 AURIAN (1300 287 426) sales@aurian.com.au

© 2026 Aurian Security Pty Ltd. ACN 639 930 528.

This site is static, loads no third-party trackers, and publishes a security.txt.