Offensive Security
API Penetration Test
Testing of REST and GraphQL APIs against the OWASP API Security Top 10: broken object-level authorisation, authentication, rate limiting and token handling.
Testing only starts after we receive written authorisation from the system owner and both sides sign off the scope and rules of engagement.
Overview
APIs expose your data directly. We test every endpoint and role combination for the authorisation and data-exposure flaws attackers automate.
What you get
- Executive summary for leadership
- Technical report with CVSS v3.1-rated findings
- Proof-of-concept evidence and reproduction steps
- Prioritised remediation guidance for your team
- Debrief session and one retest of fixed findings
How we work
- 01Scoping and rules of engagement: targets, test windows, accounts and signed authorisation
- 02Reconnaissance and attack-surface mapping
- 03Manual testing supported by tooling, exploiting findings safely to prove impact
- 04Reporting: risk-rated findings with evidence and fix guidance
- 05Debrief with your team, then a retest of the fixes
More Offensive Security services
- Web Application Penetration TestAuthenticated, manual testing of web applications against the OWASP Web Security Testing Guide and ASVS, including business-logic and access-control flaws.
- Mobile Application Penetration TestStatic and dynamic testing of iOS and Android apps against OWASP MASVS and MASTG: data storage, transport security, reverse engineering and backend APIs.
- Network Penetration TestExternal and internal infrastructure testing following PTES: exposed services, Active Directory attack paths, lateral movement and network segmentation.
- Cloud Penetration TestAdversarial testing of AWS, Azure and GCP environments: IAM privilege escalation, exposed storage and services, and cross-account trust abuse.
- Red Team & Social EngineeringObjective-based adversary simulation mapped to MITRE ATT&CK, including phishing campaigns and assumed-breach scenarios, to test detection and response.
- Remediation RetestVerification testing of fixed findings from a previous penetration test, with an updated report and an attestation letter for customers and auditors.
Have a project to scope?
Tell us your objectives and constraints. We reply within one business day.