API pentesting
API pentesting
Test your applications, methods and systems for vulnerabilities using our API pen testing. NFIR offers professional API pentesting services that can help you secure your applications from outside attacks.
How secure are your APIs really?
Have it tested by our certified ethical hackers.
Scope examples
During an API pen test, the API can be tested from different perspectives: unauthorized (Black Box) or authorized (Grey Box).
What attack scenarios are possible for API pen testing?
The most common attack scenario for an API is a combination of a Black and Grey Box. An illustrative example is provided below for both attack scenarios. During an intake, the requirements will be mapped out in order to then choose a suitable scenario together with the client.
Black Box of the API
With minimal information, a picture will be formed of vulnerabilities in the API. The possibility of using API requests without sending along the required authentication will also be explored. Through open source research (OSINT), as much information as possible will be collected to discover potential vulnerabilities based on this information.
Grey Box of the API
Testing the API from an authorized perspective is at least as important as from an unauthorized environment. This scenario mimics the actions of a malicious hacker should they gain access to a valid API token. This is accomplished, for example, by conducting a phishing attack or a social engineering attack. Questions that can be answered with this are for example: What vulnerabilities are present and is it possible to request more information than intended or send API requests that do not belong to the token's rights profile?
White Box of the API
In this attack perspective, the pentester has not only all the information about how the API works and login credentials, but also the source code of the API. This allows for more efficient pen testing, as well as checking for vulnerabilities in the software dependencies used.
NFIR and International Standards.
NFIR uses the OWASP Web Security Testing Guide (WSTG) and the OWASP API Security Top 10 for pen testing APIs. These standards give you the guarantee that the pen test will be carried out according to the correct standards and completely. We find it important to be as transparent as possible about the execution of the pen test. For this reason, we offer a checklist for various pen testing standards which is added to the report. This allows you to see which checks have been carried out, which could not be carried out and which, if any, were not applicable.
What clients have to say
Pen tests
Ministry of Health, Welfare and Sport
Digital Forensics & Pentesting
Willem van Oranje Onderwijsgroep
Security Monitoring & Pentesting
Royal Hordijk
Sample API Pen Testing Report
Sample API Pen Testing Report
A sample report (NL/EN) of a grey box web application pen test is available.
In this report, a pen test was performed on a fictitious environment, whereby vulnerabilities were made transparent.
Pen tests
Which systems can you have tested by NFIR's experts?
Which systems can you have tested by NFIR’s experts? Our ethical hackers check the technical resilience of (web) applications, websites, IT and OT infrastructures, API links and mobile apps. If you have a different environment that you would like to have controlled, we will be happy to discuss it with you.
NFIR uses reliable pentesting services, certified with the CCV Pentesting Seal of Approval. We are your Cybersecurity partner if you are looking for a down-to-earth Dutch Cybersecurity company that has years of experience in pentesting. Our certified ethical hackers identify vulnerabilities and provide concrete and actionable insights about the effectiveness of your security measures. Contact us today to put your cybersecurity under the microscope as well.
High quality pen testing
Certified and quality-oriented pentesters
Pentests are essential to test the technical resilience and effective operation of security. Our pentesters focus on identifying vulnerabilities in systems by deploying various attack techniques. Our skilled and professional pen testers have extensive experience, creativity and up-to-date professional knowledge. The pentesters have completed various relevant training courses and hold the following certifications, among others, OSCP, OSWP, OSWE, OSEP, CPTS, CBBH, and eWPT.
Pentesting and the CCV seal of approval:
- This quality mark, based on NEN-EN-ISO/IEC standards 17021 and 17065, gives customers the guarantee that the execution of a pen testing assignment by NFIR is carried out in a professional and high-quality manner.
- NFIR possesses since 07-01-2022 the CCV quality mark for Pentesting.
I want to pentest my environment(s)!
Once you fill out this form, we will contact you immediately to inform you of the possibilities. We schedule a no-obligation intake with a Technical Lead to coordinate scope components and attack scenarios.
Do you have any questions in the interim? If so, please contact us by phone at the general NFIR phone number: 088 313 0205
