api渗透测试一种模拟攻击类型吗？
no, an api pen test is looking to test the quality of the application by examining whether the apis it uses are secure. it is about identifying vulnerabilities in the apis, not validating whether the overall application can withstand an attack.
api penetration testing and web application penetration testing in general are “part art, part engineering,” which can make it hard to know what to expect and whether you got what you paid for. some questions to ask testers/vendors include: how long have you been performing api pen tests and how many have you done? have you done any with clients in my industry and/or with similar applications? what testing standards do you use as a foundation (e.g., owasp top 10, owasp asvs)? what classes of vulnerabilities will you test for? what is the experience level of the tester(s) you will use? what is your step-by-step methodology? you can also ask for a sample report.