iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Structure API security testing with OWASP ASTF as a scoped, authenticated assessment—not as a one-click scan. Define what you are authorized to test, build a dependable endpoint inventory, provide representative credentials and request data, run the API Security Top 10 checks plus relevant extensions, then review evidence and set an explicit CI policy. Authenticated tests against known routes, including a second user identity, can reveal issues that unauthenticated endpoint discovery alone will miss.
What is OWASP ASTF, and what can it test?
The OWASP API Security Testing Framework (ASTF) is an automated, dynamic security-testing framework designed around the OWASP API Security Top 10 2023. OWASP describes ASTF as a black-box tool: it sends requests to an API and analyzes responses; it does not read the application’s source code. Providing credentials, endpoint information, and realistic requests makes an assessment more informed, but does not turn ASTF into a source-code analyzer.
The OWASP project documentation identifies release v2.0.1, 16 security test cases, support for automatic endpoint discovery, multiple authentication modes, HTML, JSON, SARIF, and XML output, and GitHub Actions integration. The project page identifies it as an OWASP incubator project under the Apache 2.0 license. OWASP also reports 350 passing unit tests in its current project documentation. Those project figures describe the documented release and test suite; they are not a guarantee that every API behavior or vulnerability will be detected.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchASTF is most useful as one part of a security assessment. It can exercise endpoints and check for defined vulnerability patterns, but the results still require human interpretation, and coverage depends on the routes, identities, data, and protocols available to the scan.
#1 Best Overall
How should you choose an assessment mode?
Choose the mode that matches the assessment’s purpose. A quick black-box run is convenient for an initial look; a production-oriented assessment should generally combine a known route list with authenticated identities and representative request shapes.
| Assessment mode | Endpoint coverage | Identity and request coverage | Best fit | Important limitation |
|---|---|---|---|---|
| Unauthenticated discovery | Relies on routes the scanner can discover or reach without credentials. | Does not provide the same access to authenticated-only behavior as a credentialed run. | Initial reconnaissance in an explicitly authorized test environment. | Authenticated or undocumented routes may remain unseen; discovery alone is not a complete assessment. |
| Known endpoints with authentication | Uses an endpoint inventory supplied for the assessment. | Can exercise protected routes with configured credentials and realistic request data. | Repeatable assessment of a defined API surface. | Route-list quality and the permissions of the supplied identities limit coverage. |
| Known endpoints with two identities | Uses the defined route inventory. | Adds a distinct secondary identity for cross-user authorization checks, including exact-object URL testing. | Assessing object-level authorization and comparing access between users. | The identities must represent meaningful, separate authorization contexts; sharing a role or account weakens the comparison. |
OWASP’s ASTF testing guidelines recommend against relying on pure black-box mode alone. In practical terms, discovery is a useful starting point, not a substitute for supplying the routes and access needed to test the API’s real operating conditions.
How do you prepare scope and authorization?
Before sending requests, document the permitted targets and the limits of the test. This is both a safety measure and a way to make results interpretable: a scan cannot distinguish an intentionally excluded route from a missed one unless the scope is explicit.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Target hosts and environments: name the approved base hosts and identify whether the target is a dedicated test, staging, or production environment.
- Allowed time window and rate limits: record when scanning may run and any request-rate ceiling or operational restriction supplied by the API owner.
- Authorized identities: list the accounts and roles permitted for testing, including which identity is the primary user and which is the distinct secondary user.
- Excluded operations: identify destructive or irreversible actions, such as operations that alter real customer data, if they are out of scope.
- Permitted protocols and test areas: state whether GraphQL, gRPC, mutual TLS, or other specialized surfaces are included.
Use only systems and credentials for which you have explicit authorization. A production API can have real side effects even when a scanner is intended for security testing. If an operation’s impact or safe test behavior is uncertain, resolve that with the API owner before including it.
How do you build a reliable endpoint inventory?
ASTF can discover endpoints, but a supplied route list makes the assessment more controlled and repeatable. Use discovery to identify candidate paths, then compare those paths with the API’s documented or owner-provided inventory where available.
Use discovery for an initial route sweep
The project documents OpenAPI/Swagger probing and common-path discovery. This can help identify exposed documentation and reachable routes, but discovery can only find what is visible to the scanner under the access and configuration it has. A route that requires authentication, a special header, or an undocumented path may not appear in an unauthenticated discovery pass.
Rank #2
Use an endpoint file when scope must be deterministic
For a defined assessment, export the known routes to an endpoints file and use --no-discovery when you need to prevent automatic discovery from changing the scan’s scope. This helps make repeated runs easier to compare, provided the route file is kept current.
ASTF documents endpoint-source precedence in this order: a CLI endpoints file, inline configuration, a configured endpoint file, automatic discovery, then fallback paths. Check this order when a scan uses a different route set than expected. A higher-priority source can determine the endpoints even when another source is also configured.
Reconcile routes before interpreting omissions
- Compare the scanner’s route inventory with the API owner’s expected routes and the applicable OpenAPI/Swagger description.
- Note routes that require a particular identity, protocol, header, or request shape.
- Record deprecated versions and known shadow endpoints where they are in scope; inventory management is part of the API Top 10 coverage.
- Keep the final endpoint list with the scan record so later runs can be compared against the same intended scope.
How do you configure authentication and realistic requests?
Configure the authentication method the API actually uses. ASTF documents bearer tokens, API keys, Basic authentication, custom headers, and mutual TLS. A scan that omits the required credential may test only public behavior and fail to reach the routes that matter most.
For BOLA testing, supply a primary identity and a distinct second identity using --secondary-token. The key is not merely having two tokens: they should represent different users or authorization contexts so the scanner can compare access to the same object.
Provide representative request bodies as well as routes and credentials. Realistic fields give tests for injection and unsafe consumption something meaningful to exercise. If a route accepts structured JSON, for example, include an authorized, non-destructive representative body rather than assuming a URL-only scan covers its input handling. Do not invent or reuse production data without permission; select test data with the API owner.
Check the request setup before scanning
- Confirm that each credential is valid for the intended environment and has the role you documented.
- Check that custom headers and API keys are sent in the expected form.
- For mutual TLS, confirm that the target and test configuration support the certificate-based connection being assessed.
- Ensure request bodies match the endpoint’s expected shape closely enough to reach relevant application logic.
- Use separate identities for cross-user checks; a second token that resolves to the same user does not create a useful authorization comparison.
What do ASTF’s API1–API10 checks cover?
The baseline suite maps to all ten categories in the OWASP API Security Top 10 2023. The category names describe risk areas, not a promise that every variant of each vulnerability can be detected automatically.
| Category | What the check area concerns | Examples of behavior to assess |
|---|---|---|
| API1: Broken Object Level Authorization | Whether a user can access another user’s object. | Object-ID and cross-user authorization checks. |
| API2: Broken Authentication | Whether authentication controls can be bypassed or abused. | Missing authentication, JWT weaknesses, user enumeration, lockout, 2FA bypass, and session-cookie controls. |
| API3: Broken Object Property Level Authorization | Whether responses or updates expose or permit changes to properties beyond the user’s authorization. | Excessive data exposure and mass assignment. |
| API4: Unrestricted Resource Consumption | Whether an API can be made to consume excessive resources. | Burst and rate-limit behavior. |
| API5: Broken Function Level Authorization | Whether a user can call functions reserved for another privilege level. | Admin access, HTTP-method escalation, and privilege-tier path substitution. |
| API6: Unrestricted Access to Sensitive Business Flows | Whether important workflows lack appropriate protection against automated or abusive use. | Bot protection on login, OTP, payment, and similar flows. |
| API7: Server-Side Request Forgery | Whether user-controlled input can cause server-side requests to unintended destinations. | URL, webhook, and redirect parameters. |
| API8: Security Misconfiguration | Whether configuration choices expose unnecessary information or weaken protections. | Security headers and verbose errors. |
| API9: Improper Inventory Management | Whether API versions and exposed surfaces are understood and managed. | Deprecated versions, shadow endpoints, and exposed documentation. |
| API10: Unsafe Consumption of APIs | Whether data from integrations or downstream APIs is handled unsafely. | Integration injection and open redirects. |
Use the category map to check that your planned route set and test data are relevant. For example, a scan of only read-only public routes cannot meaningfully assess mass assignment on protected update operations or authorization differences between users.
Which specialized tests should you add?
ASTF documents six specialized areas in addition to the API1–API10 baseline: GraphQL, gRPC, mutual TLS validation, LLM prompt injection, SQL/NoSQL injection, and regular-expression denial of service (ReDoS). Select these when the API exposes the relevant protocol, input surface, or risk; running an irrelevant test does not improve coverage.
- GraphQL: include it when the API exposes a GraphQL endpoint and the authorized scope includes that surface.
- gRPC: consider the documented endpoint and reflection behavior checks when the service uses gRPC.
- Mutual TLS: use the test area when client-certificate authentication is part of the API’s trust boundary.
- LLM prompt injection: include it for endpoints backed by language-model behavior, with test data and boundaries approved by the API owner.
- SQL/NoSQL injection: include it where user-controlled values reach query or filtering behavior, and provide representative request shapes.
- ReDoS: consider it for inputs that are processed by regular-expression logic, while respecting the agreed rate and operational limits.
These checks are not interchangeable. Choose by architecture and data flow, and agree on safe test cases before running anything that could create load or trigger downstream actions.
How do you test BOLA with two users?
Use two identities with different user contexts and compare their access to the exact same object URL. OWASP’s ASTF documentation describes this as stronger BOLA evidence than relying on ID guessing, because the test checks whether the second user can access an object already identified under the first user’s context.
- Choose a non-sensitive test object that the primary identity is authorized to access.
- Record the exact object URL and confirm that the primary identity can retrieve it as expected.
- Configure a distinct secondary identity with a different authorization context using
--secondary-token. - Have the assessment request that same object URL as the secondary identity, rather than substituting guessed identifiers.
- Review the response and request evidence to determine whether the second identity received access it should not have.
A response that appears successful is a signal to investigate, not a complete authorization verdict by itself. Consider the endpoint’s intended access policy and the returned content; some APIs legitimately allow shared or public objects. Preserve enough context for the owner to reproduce the finding and decide whether it is a real access-control failure.
How do you review results and set a CI/CD gate?
Use reports for different audiences: HTML is suited to analyst review, while JSON and XML can feed downstream processing. SARIF supports integration with GitHub Code Scanning. ASTF documents exit code 0 for no findings, 1 when findings are detected, and 2 for a scan error.
Rank #4
Separate findings from scan failures
Do not treat every nonzero process result as the same outcome. Exit code 1 means the scan detected findings; exit code 2 means the scan encountered an error. A pipeline should make that distinction visible so that a failed scan is not mistaken for either a clean assessment or a confirmed vulnerability result.
Free tools Windows power users keep installed
One-click scans. No signup required.
Agree on the release policy before enforcing it
ASTF’s documented exit states identify findings, but the organization must decide how those findings affect a release. Agree on which severity or finding classes block deployment, who reviews exceptions, and how scan errors are handled. Do not assume that an exit code alone represents your organization’s risk tolerance.
Keep reports actionable
- Use SARIF for the supported GitHub Code Scanning workflow when that is part of your development process.
- Retain a human-readable HTML report for triage and a machine-readable report when other systems consume the results.
- For each finding, inspect the request and response evidence, endpoint, identity, and test context before deciding whether it is exploitable or a false positive.
- Track unresolved findings and retests against the same route and identity context where possible.
How do you make results repeatable and safe?
A useful assessment record lets another authorized reviewer understand what was tested and reproduce the relevant checks without guessing. Save the endpoint list, identity roles, configuration, ASTF version, timestamps, findings, and retest results together.
Control rate and impact deliberately. The API4 resource-consumption category includes burst and rate-limit behavior, but the fact that a framework tests rate-limit behavior does not authorize an unlimited load test. Keep to the agreed rate limits and test window, and exclude destructive operations unless they are expressly approved and safely controllable.
After remediation, rerun the relevant test with the same route and identity setup, then update the record with the new outcome. If the endpoint list, credentials, or request shapes changed, note that change: a different test setup can explain a different result without proving that the original issue was fixed.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →What are ASTF’s main coverage limits?
ASTF is dynamic and black-box, so it can only assess behavior it can reach through the configured API surface. It does not inspect source code. Auto-discovery-only results are incomplete when authenticated or undocumented routes are not exposed to discovery, and a missing finding is not proof that a route is secure.
- Incomplete inventory: routes omitted from the supplied list or inaccessible to discovery are not meaningfully covered.
- Insufficient identity coverage: one account cannot establish cross-user access behavior, and credentials without appropriate roles can hide authorization paths.
- Unrepresentative requests: missing or unrealistic bodies may prevent tests from exercising important input-handling behavior.
- Protocol mismatch: a baseline API scan does not replace the specialized check relevant to GraphQL, gRPC, mutual TLS, or LLM-backed behavior.
- Unreviewed findings: automated results need interpretation against the API’s intended authorization and business rules.
Use ASTF as a repeatable testing layer alongside API ownership knowledge and security review. Its results are strongest when the scope is explicit, the test identities are meaningful, and a reviewer checks the evidence rather than treating a scan summary as a final verdict.
Frequently Asked Questions
Does OWASP ASTF read my application’s source code?
No. OWASP describes ASTF as a black-box dynamic tool that sends requests to the running API rather than inspecting source files. Source-code-specific analysis requires a separate method.
Can I run ASTF against a production API?
Only with explicit authorization and operational limits agreed with the API owner. Confirm the permitted window, rate ceiling, test identities, and excluded actions first, especially when requests could affect real users or downstream systems.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What should I do if ASTF exits with code 2?
Treat it as a scan error, not as a clean result or a finding verdict. Diagnose the scan failure, correct the configuration or connectivity issue, and rerun before using the assessment as a release signal.
Does ASTF replace manual API security testing?
No. Automated checks can identify useful evidence, but reviewers still need to verify intended access rules, investigate findings, and assess behaviors the configured routes and requests do not exercise. A clean scan alone does not establish that the API is secure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
