More and more companies have been expanding their target audience by extending their host of web services to others and providing interfaces for automated services, such as a Single Sign-On (SSO) using an Application Programming Interface (API).

Now let’s get started! History: What is an API? Please feel free to reach out to me or comment below if you ever have any questions or comments on Burp Suite and I’ll make sure to help in any way I can. I hope this series will be helpful to my fellow security enthusiasts of all skill levels. Part 2 will consist of the actual penetration testing itself, and Part 3 will be on formatting our results and generating a detailed report. Part 1 will be covering the dos and don’ts of configuring and optimizing our scan engine to make sure we’re set for success. That said, if you happen to have a RESTful API service that you’re looking to conduct a penetration test against, then make sure to stick with me as we dig into the specifics for how to make sure you leave no stone unturned. Due to the subject matter being relatively technical, I’m making some assumptions that you will be at least familiar with the concepts behind conducting penetration testing and vulnerability analysis. Welcome to our 3-part blog series where we will take a dive into the technical aspects of conducting exhaustive penetration tests against REST API services, generating reports based on what tests were performed, and what our findings are.

Pen Testing REST API with Burp Suite Introduction:

Burp suite pro scanner tutorial