Web service scanning

Critical tests:

  • API authentication/authorisation

  • Input validation

  • Rate limiting

  • Data exposure

Tools:

  • Postman + Newman

  • OWASP ZAP

  • Burp Suite