BSCPMethod
API testing
Outline only. APIs are the same trust decisions as pages, with less UI to hide a missing check.
8 min read · Academy topic: API testing · Outline, not a finished note
Outline. This module is on the map so you can track it. The page below is a writing checklist, not finished study material.
Objectives
- Map methods, object ids, and content types before testing
- Reuse the access-control and injection notes instead of inventing a new bug
TODO
This should become a method note, not a payload list.
Checklist
- Inventory methods on each object. A UI that only uses GET may still leave other methods enabled.
- Identifiers in the path are the access-control question again.
- JSON bodies are still data. Injection depends on whether that data is concatenated into a query, a command, or a template.
- Mass assignment is a logic and access issue: the client sends a field the feature never displayed, and the server copies it onto the record.
- Authentication schemes (cookie, bearer token, API key) change which notes apply. CSRF matters for cookie-authenticated browsers. It matters less for a header a foreign page cannot set. Say which one the lab uses.
- Repeater and the map are the tools. Intruder only after a baseline, with a short lab list.