Overview of Scanning APIs

Acunetix 360 can scan web applications that use Application Programming Interfaces (API).

• When most people think of web security, they think about testing websites and web applications. Over 80% of web traffic, however, is actually sent through web APIs.
• These attacks are also expected to increase. Gartner’s report How to Build an Effective API Security Strategy predicted that APIs would become the number one attack vector in 2022.

Challenges to scanning APIs

Despite these warnings and the increasing trend to attack APIs, it remains, however, a challenge to secure them because of the following reasons:

• There isn’t a clear standard to secure APIs in order to avoid vulnerabilities. To secure APIs, its unique logic needs to be understood.
• APIs and web applications use the same language and technologies. This means APIs are also prone to the same types of security risks and attacks, for example, SQL injection attacks. However, as APIs are discrete endpoints and if the scanners do not know how to find these endpoints, the scanners cannot test APIs security.
• Also, the fast pace of development means the constant evolution of APIs. So, this pace turns API security into a challenge.

As an advanced black-box security tool, Acunetix 360 can scan websites, web applications, and web services, and identify security flaws. It can scan all types of web applications, regardless of the platform or language they are built. So, Acunetix 360 can identify vulnerabilities in your APIs and offer remedies to fix them.

Scanning APIs with Acunetix 360

You can use Acunetix 360 to identify vulnerabilities related to gRPC, SOAP, REST, and GraphQL API. Each topic is explained in its respective topics:

• Scanning gRPC API Web Services 
• Scanning a RESTful API Web Service
• Scanning a GraphQL API for vulnerabilities
• Scanning SOAP API Web Services

Using Postman or Fiddler? Acunetix 360 supports such tools to import your links for the security testing. For further information, see Importing Links and API Definitions and Importing links from supported tools.

Curious about security concerns related to web APIs in your web application? See OWASP API Top Ten 2019 Report.