US 12,267,352 B2
Rest API scanning for security testing
Ganesh Nikam, Pune (IN); and Akash Shah, Pune (IN)
Assigned to Qualys, Inc., Foster City, CA (US)
Filed by Qualys, Inc., Foster City, CA (US)
Filed on Oct. 16, 2023, as Appl. No. 18/380,411.
Application 18/380,411 is a continuation of application No. 17/683,214, filed on Feb. 28, 2022, granted, now 11,792,221.
Application 17/683,214 is a continuation of application No. 16/920,380, filed on Jul. 2, 2020, granted, now 11,265,342, issued on Mar. 1, 2022.
Prior Publication US 2024/0064167 A1, Feb. 22, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06F 9/445 (2018.01); G06F 9/54 (2006.01); G06F 16/951 (2019.01); H04L 67/133 (2022.01)
CPC H04L 63/1433 (2013.01) [G06F 9/44505 (2013.01); G06F 9/541 (2013.01); G06F 9/547 (2013.01); G06F 16/951 (2019.01); H04L 63/1466 (2013.01); H04L 67/133 (2022.05)] 22 Claims
OG exemplary drawing
 
1. A method for securing an application programing interface (API) against a vulnerability, the method comprising:
accessing, using one or more computing device processors, an API testing tool;
generating or receiving, using the one or more computing device processors and the API testing tool, API workflow data;
generating or accessing, using the one or more computing device processors, and based on the API workflow data, a scan configuration file, the scan configuration file being executable;
determining, using the one or more computing device processors, at least one endpoint;
determining, using the one or more computing device processors, that the at least one endpoint accesses a resource of an application server via a first API;
executing, using the one or more computing device processors, one or more commands associated with API requests, the one or more commands comprising at least one of a POST command, a GET command, a PUT command, and a DELETE command;
crawling, using the one or more computing device processors, content associated with a link comprised in or associated with the API requests to generate crawled data;
executing, using the one or more computing device processors, and based on the crawled data, one or more vulnerability tests;
determining, using the one or more computing device processors, and based on the one or more vulnerability tests, API data associated with the one or more vulnerability tests;
generating, using the one or more computing device processors, and based on the API data, scan data indicative of at least one vulnerability associated with the first API; and
generating, using the one or more computing device processors, a vulnerability report based on the scan data.