Skip to main content
availability

Deployment: Invicti Platform on-demand, Invicti Platform on-premises

Overview of scanning APIs

Invicti Platform can scan Application Programming Interfaces (APIs). When most people think of web security, they think of testing websites and web applications. However, over 80% of web traffic is actually sent through web APIs. Invicti Platform is a web vulnerability solution for securing your APIs, web applications, websites, and more.

Scanning APIs with Invicti Platform​

APIs and web applications use the same language and technologies, which means they're also prone to the same types of security risks and attacks, such as SQL injection attacks. Since APIs are discrete endpoints, scanners need to know how to find them to test their security. Invicti Platform offers API scanning through the import or linking of API specification files.

Specifically, you can use the Invicti Platform to identify vulnerabilities in your SOAP, REST, and GraphQL APIs. The scan results offer remedies to fix the identified vulnerabilities in the same way that you view scan results for your web applications and websites.

Key API vulnerabilities detected by Invicti Platform​

APIs are susceptible to various security vulnerabilities. Invicti Platform automatically detects critical API security issues, including:

Access control vulnerabilities​

Access control vulnerabilities are among the most critical API security risks, consistently ranking #1 in the OWASP API Security Top 10:

  • BOLA (Broken Object Level Authorization) - Users can access data belonging to other users by manipulating object identifiers
  • BFLA (Broken Function Level Authorization) - Regular users can access administrative functions or privileged operations
  • IDOR (Insecure Direct Object References) - Applications expose references to internal objects that can be manipulated

Example: A user changes /api/user/123 to /api/user/456 and gains access to another user's profile data.

Other common API vulnerabilities​

  • Injection attacks (SQL injection, NoSQL injection, command injection)
  • Authentication and session management flaws
  • Data exposure through overly verbose API responses
  • Rate limiting bypass and denial of service vulnerabilities
  • Input validation issues and malformed data handling
Access control testing resources

For comprehensive guidance on testing access control vulnerabilities:

Scanning APIs in production

Scanning production APIs should be conducted with care. Some scanning methods may result in data deletion. It's recommended to:

  • Carefully consider the permissions (authentication) you provide and which methods (PUT, POST, DELETE) are used.
  • Manually exclude API operations (methods with endpoints) from the uploaded/linked file to prevent destroying or making undesirable changes to the production application.

Use internal URL references for API specifications​

Invicti Platform supports adding API specifications via URLs that may not be immediately accessible from the cloud environment, such as URLs hosted on internal or private networks. This feature works with all supported API specification formats (OpenAPI/Swagger, GraphQL, RAML, WADL, WSDL).

How it works​

Instead of downloading the API specification immediately when you save the URL, the system:

  • Stores the URL as a reference only
  • Resolves the specification at scan runtime via the agent
  • Downloads the specification fresh with every scan
  • Accesses the URL from the agent's network context (which may include internal networks)

Use cases​

This feature is designed for scenarios where:

  • API specifications are hosted on internal infrastructure not accessible from the cloud
  • Specifications need to reflect the latest version at each scan
  • You want to avoid exposing internal URLs to the cloud environment

Steps to add an internal URL for API specifications​

  1. Select Inventory from the left-side menu.
  2. Click the target for which you want to add the API specification URL.
  3. Click Edit.
  4. Under Scan configuration, choose General.
  5. Select Link from URL.
  6. Using the drop-down, specify the API type and enter the URL.
  7. Confirm this by clicking Link API specification.

At scan time, the agent attempts to download the specification from the provided URL using its network access.

info

API specifications added via URL references aren't displayed in the API Hub.

Scanning authenticated APIs​

Invicti Platform also supports scanning APIs that require authentication. The available authentication methods are all configured via the target settings page. These include authentication via API key, Bearer token, JWT token, Basic authentication, and OAuth 2.0.

Multi-user access control testing​

For comprehensive security testing, configure multiple sets of credentials with different privilege levels. This enables Invicti Platform to detect access control vulnerabilities by testing whether:

  • Regular users can access other users' data (horizontal access control issues)
  • Regular users can access administrative functions (vertical access control issues)

For more information, refer to the configure API authorization for access control testing document.

Troubleshooting API scans​

These issues apply to REST, SOAP, and GraphQL scans alike. The main difference is that the operations preview is available only for REST APIs (OpenAPI/Swagger). GraphQL and WSDL specifications don't support preview.

The scan didn't test the API or found no API vulnerabilities

Confirm the specification imported: open the target's General scan configuration and confirm your file or linked URL appears in the API specification section. For REST APIs, click the specification to open the operations preview and verify the expected endpoints appear. If operations are missing, the format may be wrong or the file incomplete. Re-upload the correct file for your API type:

  • REST: OpenAPI, Swagger, RAML, WADL, or Postman
  • GraphQL: a schema or introspection result
  • SOAP: a WSDL
Invicti can't reach a linked API specification URL

When you link a URL instead of uploading a file, the scan engine - or the internal agent assigned to the target - must be able to reach that URL at scan time. Confirm the URL is accessible from the scanning environment and isn't blocked by network restrictions or by authentication that Invicti doesn't have. For URLs on internal or private networks, use the reference feature described in Use internal URL references for API specifications.

Need help?​

Invicti Support team is ready to provide you with technical help. Go to Help Center

Last updated on
Was this page useful?