Belajar Security Tester - API Security Testing

#Pendahuluan

Setelah di episode 5 kita menguji authentication & session, pada episode ini kita fokus pada target yang semakin dominan di 2026: API. Setiap aplikasi modern berkomunikasi via API, dan API yang tidak aman bisa membocorkan data sensitif hanya dalam satu request.

#OWASP API Security Top 10

API memiliki Top 10 khusus yang sedikit berbeda dari Web Application Top 10:

#	Vulnerability	Contoh
API1	Broken Object Level Authorization	GET /api/users/2 dengan token user 1
API2	Broken Authentication	Token tidak expired, brute force
API3	Broken Object Property Level Authorization	Field sensitif di-response
API4	Unrestricted Resource Consumption	Tidak ada rate limit
API5	Broken Function Level Authorization	User biasa akses admin endpoint
API6	Unrestricted Access to Sensitive Business Flows	Auto-purchase tanpa limit
API7	Server Side Request Forgery	SSRF via API parameter
API8	Security Misconfiguration	Verbose error, CORS wildcard
API9	Improper Inventory Management	Old API version masih aktif
API10	Unsafe Consumption of APIs	Trust external API tanpa validasi

#Authorization Testing

bash

# Test BOLA - akses objek user lain
curl -H "Authorization: Bearer <user1_token>" \
  http://localhost:3000/api/users/2
 
# Test broken function level authorization
curl -H "Authorization: Bearer <user_token>" \
  http://localhost:3000/api/admin/users

#Rate Limiting

bash

# Test rate limiting - kirim banyak request
for i in $(seq 1 100); do
  status=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST http://localhost:3000/api/login \
    -H "Content-Type: application/json" \
    -d '{"email":"test@test.com","password":"wrong"}')
  echo "Attempt $i: $status"
done

#Input Validation & Injection

bash

# SQL injection via API
curl -X POST http://localhost:3000/api/search \
  -H "Content-Type: application/json" \
  -d '{"query": "\" OR 1=1--"}'
 
# NoSQL injection
curl -X POST http://localhost:3000/api/search \
  -H "Content-Type: application/json" \
  -d '{"query": "{\"$gt\": \"\"}"}'

#GraphQL Specific

bash

# Introspection query - list semua schema
curl -X POST http://localhost:3000/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "{__schema{types{name,fields{name}}}}"}'
 
# Batch query attack
curl -X POST http://localhost:3000/graphql \
  -H "Content-Type: application/json" \
  -d '[{"query":"{user(id:1){email}}"},{"query":"{user(id:2){email}}"}]'

Tip

Selalu test API dengan berbagai Content-Type: application/json, application/xml, application/x-www-form-urlencoded. Beberapa vulnerability hanya muncul dengan content-type tertentu.

#Praktik: API Security Scan

bash

# Gunakan OWASP ZAP API scan
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
  -t http://localhost:3000/openapi.json -f openapi -r api-report.html

#Penutup

API1-3: Broken authorization & authentication — test akses lintas user dan expired tokens.
API4: Rate limiting — pastikan ada limit pada login, search, dan resource consumption.
API5: Function level authorization — user biasa tidak boleh akses admin functions.
API9: Inventory management — pastikan old API versions sudah dimatikan.

Di episode 7 selanjutnya kita akan membahas tools: Burp Suite & ZAP secara mendalam — intercept, scanner, extensions, dan workflow efektif. Sampai jumpa di episode 7!