Documentation
  • ๐ŸปIntro
    • Why API Security is Critical?
    • Pynt at a Glance
    • Who Should Use Pynt?
  • ๐Ÿ‘ฉโ€๐Ÿ’ปAPI Security Testing
    • Security Testing Overview
    • Prerequisites for Running Pynt Scans
    • How to Install Pynt CLI
    • How to install Pynt Binary (Linux only)
    • Pynt CLI Modes
      • ๐Ÿ”ตPynt Command CLI Mode
      • ๐Ÿ”ตPynt Listen CLI Mode
    • Pynt Security Tests Coverage
      • Business Logic Tests
      • Injection Tests
      • Authentication Bypass Tests
      • Mass Assignment Tests
      • Server-Side Request Forgery Tests
      • Stack Trace In Response
      • Lack of Resources and Rate Limiting
      • File Path Manipulation
      • GraphQL Introspection Vulnerability
      • GraphQL Alias Overloading
      • LLM APIs Vulnerabilities
      • Insecure Transport Scheme
      • Basic Authentication
      • HTTP Desynchronization (Desync) Attack
    • Sensitive Data Exposure Detection
    • Pynt Scans Troubleshooting
      • Pynt CLI Troubleshooting
      • Pynt for Postman Troubleshooting
        • Troubleshoot Pynt Container not Running Error
        • Troubleshoot Empty API Key Error
        • Troubleshoot Unauthorized API Key Error
        • Troubleshoot Collection Not Found Error
        • Troubleshoot Non-Unique Collection Name Error
        • Troubleshoot Empty Collection Identifier Error
        • Troubleshoot Unreachable Target Error
        • Troubleshoot Target Responds with Errors Error
        • Troubleshoot Unresolved Target Domain Error
        • Troubleshoot Unresolved Variable Error
        • Troubleshoot TLS Handshake Fail Error
        • Troubleshoot Few Requests Error
        • Troubleshoot One User Only Error
        • Troubleshoot Failed Assertions Error
    • How To
      • How to Run Business Logic Tests with Pynt
      • How to associate a Pynt scan to an Application in Pynt Dashboard
      • How to tag a scan in Pynt
    • Benchmarks
      • Pynt vs OWASP crAPI
  • ๐ŸคฒSecurity Testing Integrations
    • ๐ŸŸ Pynt with API Testing Tools
      • ๐Ÿ”˜Pynt for Postman
        • Fork Pynt Collection
        • Run Pynt Container
        • Run Pynt in Postman
        • View Scan Results in Postman
      • ๐Ÿ”˜Pynt for Insomnia
      • ๐Ÿ”˜Pynt for ReadyAPI
    • ๐ŸŸ Pynt with API Testing CLIs
      • ๐Ÿ”˜Pynt for Newman (Postman CLI)
      • ๐Ÿ”˜Pynt for TestRunner (ReadyAPI CLI)
    • ๐ŸŸ Pynt with Testing Frameworks
      • ๐Ÿ”˜Pynt for .NET (xUnit)
      • ๐Ÿ”˜Pynt for Selenium
      • ๐Ÿ”˜Pynt for Rest Assured
      • ๐Ÿ”˜Pynt for Jest
      • ๐Ÿ”˜Pynt for pytest
      • ๐Ÿ”˜Pynt for Go
      • ๐Ÿ”˜Pynt for JMeter
    • ๐ŸŸ Pynt on CI/CD
      • โ—How to get Pynt ID for CI/CD Authentication
      • ๐Ÿ”˜Pynt for GitHub Actions
      • ๐Ÿ”˜Pynt for Azure DevOps Pipelines
      • ๐Ÿ”˜Pynt for GitLab
      • ๐Ÿ”˜Pynt for Jenkins
    • ๐ŸŸ Pynt with Burp Suite
    • ๐ŸŸ Pynt with Browsers
      • ๐Ÿ”˜Pynt for Firefox Browser
    • ๐ŸŸ Live Traffic Connectors
      • ๐Ÿ”˜eBPF
        • ๐Ÿ”˜Key Components
      • ๐Ÿ”˜Traffic Mirroring
    • ๐ŸŸ Advanced Pynt Examples
      • ๐Ÿ”˜Pynt as a Standalone Container
      • ๐Ÿ”˜Pynt with Prerecorded Har Files
      • ๐Ÿ”˜Pynt with cURL
  • ๐ŸˆธApplications View
    • Application View Overview
    • Manage Applications
      • Add Application
      • Delete Application
      • Rename Application
    • Manage Sources for API Discovery
      • Add Source
      • Delete Source
      • View Source Info
      • Source Categories
        • API Documentation
          • Swagger
          • Postman Collection
        • API Gateways
          • AWS API Gateway
          • Azure API Gateway
          • Kong API Gateway
          • GCP API Gateway
          • Gravitee API Gateway
        • Testing (API Security Scans)
        • Live Traffic
          • Data Collection with eBPF
          • ALB Traffic Capture with AWS Traffic Mirroring
        • Code Repository
    • Application Dashboard
    • Generate Pentest Report
  • ๐Ÿ“šAPI Catalog
    • API Catalog Overview
    • Navigate API Catalog
      • Filtering API Catalog by Application
      • API Catalog Customization
      • API Related Info
      • APIs at Risk
    • Manage API Source Gaps
      • New APIs
      • Untested APIs
      • Shadow APIs
      • Undocumented APIs
    • View Detailed Endpoint Info
  • โชScan History
    • Scan History Overview
    • Navigate Scan History
      • Associating Scans with Specific Application
      • Filtering by Application
      • Scan Related Info
      • Scan History Customization
    • View Detailed Scan Info
    • Associate Vulnerabilities to Tickets with JIRA
  • Account Management
    • Single Sign-On (SSO)
      • Setting up Okta
      • Setting up Entra ID
Powered by GitBook
On this page
  • Likelihood
  • Impact
  • Risk Matrix
  • Open API/Swagger based risk calculation
  1. API Catalog
  2. Navigate API Catalog

APIs at Risk

Pynt's system automatically assigns risk score for each endpoint, the risk scoring is calculated based on the likelihood and impact of the detected vulnerabilities, using the below matrix.

Identify and manage APIs at risk with Pyntโ€™s automated risk scoring system. Pynt assigns a risk score to each API endpoint based on the likelihood and impact of detected vulnerabilities, using a sophisticated risk matrix. This scoring system helps you quickly identify which APIs are most at risk, allowing you to prioritize security efforts where they are needed most.

The risk score is calculated by analyzing the vulnerabilities found during security scans, considering both the probability of exploitation and the potential damage they could cause. By understanding the risk levels of your APIs, you can take targeted actions to mitigate threats and protect your critical assets. Pyntโ€™s risk scoring system provides a clear and actionable overview of your API security posture, helping you maintain a secure and resilient API environment.

Likelihood

The likelihood of occurrence is determined through a systematic evaluation of the potential that a threat actor can successfully exploit a specific vulnerability or a combination thereof.

Impact

The Impact score for a threat signifies the potential extent of harm resulting from the exploitation of a detected vulnerability. This includes unauthorized information disclosure, unauthorized information alteration, unauthorized information destruction, or the loss of both information and information system availability.

The below table shows the impact and likelihood assigned for each of the vulnerabilities category*

Category
Impact
Likelihood

Business Logic

2

4

Injections

4

4

Authentication bypass

2

4

Mass Assignment

2

1

Server-Side request forgery

3

3

Stack trace in response

2

1

Lack of Resources and Rate Limiting

2

4

File path manipulation

3

3

  • When the endpoint processes Personally Identifiable Information (PII), it amplifies the impact score of the vulnerabilities.

  • The presence of multiple vulnerabilities within a single endpoint can elevate the impact, such as when Broken Object Level Authorization (BOLA) and insufficient rate limiting co-occur, leading to the highest impact score. In other cases the maximum score in applied

  • Should our system lack sufficient details regarding the endpoint, such as absent documentation and tests not executed on the endpoint, the risk will be indicated as N/A.

Risk Matrix

Each finding's risk level is determined from four possible categories: Critical, High, Medium, or Low risk level. This determination was made by assessing the potential impact magnitude and the likelihood of exposure exploitation, with reference to the provided table.

Open API/Swagger based risk calculation

When risk is assessed using API documentation only, it is determined as follows:

Likelihood:

Likelihood is derived from factors such as the attack surface (e.g., parameter count), authentication methods or their absence and parameter types

The likelihood score is calculated based on the attack surface (e.g. number of parameters), the authentication method or lack there of and the type of the handled parameters

Impact: The impact score is calculated based on the endpoint's sensitivity, such as its handling of PII

PreviousAPI Related InfoNextManage API Source Gaps

Last updated 9 months ago

๐Ÿ“š
Risk Matrix