Rest API Scanning for Security Testing

A system for securing an API against a vulnerability, the system comprising:

• one or more computing system processors;
• and
• memory storing instructions comprising a web application scanner that is executable by the one or more computing system processors to cause the system to:
• receive API data associated with an API testing tool;
• generate a scan configuration file based on the API data, the scan configuration file being executable to assess a security posture of a first API based on a collection of API requests associated with the API data;
• crawl, using the one or more computing system processors, the collection of API requests, wherein to crawl includes the one or more computing system processors causing the system to:
• retrieve a link associated with the collection of API requests;
• crawl the link to generate a crawled link response;
• execute one or more vulnerability tests on the crawled link response, wherein to execute the one or more vulnerability tests comprises the one or more computing system processors causing the system to:
• fuzz the link retrieved and transmit the fuzzed link in a request comprised in the collection of API requests to an application server;
• or
• generate scan data indicative of at least one vulnerability associated with a response from the application server, responsive to transmitting the fuzzed link to the application server;
• and
• generate a vulnerability report based on the scan data.

A computer program product for securing an application programming interface (API) against a vulnerability, the computer program product comprising a non-transitory computer usable medium including a computer readable code, wherein the computer readable code when executed using one or more computing device processors, causes the one or more computing device processors to:

• receiving, using one or more computing devices processors, API data associated with an API testing tool;
• generating, using the one or more computing device processors, a scan configuration file based on the API data, the scan configuration file being executable to assess a security posture of a first API based on a collection of API requests associated with the API data;
• crawling, using the one or more computing device processors, the collection of API requests, the crawling including:
• identifying and retrieving a link associated with the collection of API requests;
• scanning the link to generate a scanned link response;
• executing, using the one or more computing device processors, one or more vulnerability tests on the scanned link response, the executing comprising:
• applying at least one passive detection rule to the scanned link response;
• fuzzing the link retrieved and transmitting the fuzzed link in a request comprised in the collection of API requests to an application server;
• and
• generating, using the one or more computing device processors, scan data indicative of at least one vulnerability associated with a response from the application server, responsive to transmitting the fuzzed link to the application server.