An Automated Vulnerability Assessment Approach for WebAPI that Considers Requests and Responses

In recent years, WebAPIs are being published to allow external users to use Web services. On the other hand, the number of attacks that exploit WebAPI vulnerabilities is increasing. In order to prevent damage caused by abusing WebAPI vulnerabilities, the OWASP (Open Web Application Security Project) has published a guideline (OWASP API Security Top 10) describing the 10 vulnerabilities with the highest security risk in WebAPIs. However, the guideline does not describe the methods of attack and detailed countermeasures. Therefore, there are some vulnerabilities that are difficult to detect with existing WebAPI vulnerability assessment tools. In this paper, we propose a vulnerability assessment method that automatically obtains the WebAPI reference and repeatedly analyzes the requests through WebAPI and their responses. The proposed vulnerability assessment method will enable vulnerability assessment for vulnerability items that are difficult to be detected by existing vulnerability assessment tools among vulnerability items described in the guideline (OWASP API Security Top 10).