API Security Testing¶

Wallarm API Security Testing proactively uncovers security issues (vulnerabilities) in your applications and APIs before attackers can exploit them. From this article, you will learn what a security issue is and how the Wallarm platform detects security issues, so you can enhance the security of your applications and APIs.

What is security issue?¶

A security issue (vulnerability) is an error made due to negligence or inadequate information when building or implementing an application. A vulnerability can be exploited by an attacker to cross privilege boundaries (i.e. perform unauthorized actions) within an application.

What security issues are detected?¶

Wallarm detects security issues of different types including the ones related to server and client-side attacks, authentication and access, business logic, data leaks and others. See the full list of types.

Detection methods¶

To detect vulnerabilities in the applications and APIs, Wallarm uses the following methods:

Passive detection: works only for the scope with the monitoring filtration mode; identifies vulnerabilities and incidents by analyzing real traffic, including both requests and responses. This can happen during a security incident, where a real flaw is exploited, or when requests show signs of vulnerabilities, like compromised JWTs, without direct flaw exploitation. Requires an installed Wallarm node.

Available in both Cloud Native WAAP and Advanced API Security subscriptions, also in Security Edge Free Tier.
API Attack Surface Management (AASM): discovers external hosts with their APIs, for each of them identifies missing WAF/WAAP solutions and vulnerabilities. Does not require an installed Wallarm node.

Available in the Advanced API Security subscription, can be added to Cloud Native WAAP by request, can be used alone in the separate API Attack Surface subscription.

See details on each method in the corresponding sections below along with the information of why and how to combine these methods.

Passive detection¶

Filtration mode

Passive detection works only for the scope with the monitoring filtration mode.

Passive detection refers to identifying vulnerabilities by analyzing actual traffic, including both requests and responses. Vulnerabilities may be uncovered during a security incident, where a malicious request successfully exploits a flaw, resulting in the detection of both an incident and a vulnerability. Or when requests show signs of vulnerabilities, like compromised JWTs, without direct flaw exploitation.

For example, if a request carries a path traversal payload such as GET /?file=../../../../etc/passwd and the response returns the actual contents of /etc/passwd, Wallarm concludes that the endpoint is vulnerable and records both an incident (the flaw was successfully exploited) and a path traversal vulnerability.

Passive vulnerability detection is enabled by default.

API Attack Surface Management (AASM) ¶

Wallarm's API Attack Surface Management (AASM) is an agentless (does not require Wallarm node installation) detection solution tailored to the API ecosystem, designed to discover external hosts with their APIs, identify missing WAF/WAAP solutions, and mitigate API Leaks and other vulnerabilities. AASM:

Discovers external hosts and their APIs (including hosting e.g. CDN, IaaS, or PaaS providers).
Discovers if APIs are protected by WAFs/WAAPs and from which type of threats they protect.
Discovers vulnerabilities (security issues) related to the found APIs.
Allows further management of discovered vulnerability mitigation.

Combining methods¶

Wallarm provides two detection methods that complement each other, so in most cases it makes sense to use them together:

Passive detection works wherever a Wallarm node is deployed. It finds vulnerabilities by analyzing the traffic that actually passes through the node (including on internal resources), but only once a vulnerability shows up in that traffic — for example, when an attacker exploits it.
AASM is agentless and needs no node. It actively scans your internet-facing perimeter, so it also finds forgotten external hosts and APIs that no node protects, and probes them itself instead of waiting for traffic — but it reaches only resources accessible from the internet.

Because the methods cover different surfaces, they overlap only partially: some vulnerability types are detected by just one of them.

False positives¶

False positives in vulnerability scanning may occur due to unique attributes or behaviors of each protected application. For example, similar responses to similar requests might signal an active vulnerability in one application, while for another, this may be completely expected and safe behavior.

When useful

Marking issues as false positives is useful because it allows you to:

Tailor security findings to your specific environment.
Reduce alert noise and avoid distractions from irrelevant findings.
Focus on vulnerabilities that truly require attention.
Prevent unnecessary effort spent on known safe cases.
Ensure security teams can efficiently prioritize and address real threats.

Two ways of creating

You can mark security issues as false positives in two ways:

Manually: In the issue details in Wallarm Console, add an appropriate mark to the vulnerability. A vulnerability marked as a false positive will be closed and will not be rechecked.
Automatically: Create false positive rules in Security Issues → Configure → False positive rules to automatically mark matching issues as false positives or prevent them from being created based on user-defined conditions.

Common scenarios for automatic rules

Automatically mark as false all future vulnerabilities for a specific parameter or endpoint
Do not create vulnerabilities for a specific host (e.g. honeypot, demo host)
Do not show vulnerabilities of a specific type at all

Managing discovered security issues¶

All detected vulnerabilities are displayed in the Wallarm Console → Security Issues section. You can manage vulnerabilities through the interface as follows:

View and analyze vulnerabilities
Close vulnerabilities or mark them as false positives

If you use the API Discovery module of the Wallarm platform, vulnerabilities are linked with discovered API endpoints, e.g.:

For more information on managing vulnerabilities, see the instructions on working with vulnerabilities.