api渗透测试寻找什么？
in an api penetration test, testers exercise the api function calls with mostly automated tools (and potentially also examine the source code) to see if the api calls are vulnerable to known attacks such as those documented in the owasp前10个web应用程序安全风险。尝试绕过经常利用api的认证方法尤为重要。访问控制漏洞（例如，idor）也是一个关键的焦点。 xml攻击向量和通用api安全性错误配置也是关键。
when a web app is compromised, the results can include data breaches, data exfiltration, fraud, customer account takeovers, compromised control systems, embarrassing performance problems, and exposed application code or business logic. depending on what data and/or systems are compromised, the financial and reputational damage could be massive, especially in relation to the cost of the testing.