External Network Penetration Testing
An attacker's view of your internet-facing servers, services and remote access points.
Services
API Penetration Testing
In modern applications, the real work happens in the APIs. Your mobile app, your web front end and your partners all hit the same endpoints, and a single authorisation flaw can expose all of your customer data.
The most critical topic in API testing is broken object level authorisation (BOLA). We systematically check whether a user can access someone else's data simply by changing an ID.
We can work from OpenAPI/Swagger documentation, Postman collections or sample traffic. If there is no documentation, we discover the endpoints ourselves.
What we test
- Object- and function-level authorisation (BOLA, BFLA)
- Authentication, token handling, JWT and OAuth 2.0 flows
- Mass assignment and excessive data exposure
- Rate limiting, resource consumption and abuse scenarios
- Injection and input validation; GraphQL-specific risks
- Versioning, legacy endpoints and inventory gaps
How we work
Inventory
We build a list of all endpoints, roles and data models from documentation and traffic.
Authorisation matrix
We define which resources each role should reach and test for deviations.
Attack scenarios
We apply the OWASP API Top 10 risks to your business flows through manual testing.
Reporting
Findings per endpoint, sample request/response pairs and remediation advice.
What you receive
- Executive summary
- Findings listed per endpoint
- Sample HTTP requests and evidence
- Authorisation matrix and remediation advice
A good fit for
- Mobile app backends
- Integration APIs exposed to partners
- Microservice architectures
Frequently asked questions
Do you test GraphQL?
Yes. We also cover GraphQL-specific topics such as introspection, query depth, batching and field-level authorisation.
What do you need from us?
At least two test accounts per role, API documentation (if available) and the address of the test environment.
Related services
Internal Network Penetration Testing
How far can an attacker get once inside your network? Testing for Active Directory and internal systems.
Vulnerability Assessment
Broad scanning, verification and prioritisation of known vulnerabilities across your systems.
See your weaknesses before attackers do.
Let's define the scope together. You'll receive a written proposal with the right type of test and a clear timeline.