api渗透测试可以防止什么？
when a web app is compromised, the results can include data breaches, data exfiltration, fraud, customer account takeovers, compromised control systems, embarrassing performance problems, and exposed application code or business logic. depending on what data and/or systems are compromised, the financial and reputational damage could be massive, especially in relation to the cost of the testing.
you can test apis at any time, and the sooner the better. unlike a “final” application penetration test intended to verify the overall security of a web application prior to launch, the sooner you know about defects in your apis the sooner you can rectify them. it’s also important to update and retest your apis on a regular basis (e.g., once per quarter) so that you don’t end up with a growing “snowball” of expensive-to-fix vulnerabilities as your apis are updated over time.