Ask HN: Help me. Should I build a REST API security scanner?
I have spent the last 20 years building enterprise software in different sectors, also taking part in presales and technical due dilligence activities during M&A processes both on the buyer and the seller side.
Observing the landscape of application security tools and practices across multiple companies I have noticed a recurring pattern.
The application security sector appears primarily focused on two objectives: a) Independent researchers and boutique firms working hard to uncover new vulnerabilities and provide best practices. b) Large corporations producing web security tools that, to me, seem somewhat outdated. These tools often approach web applications as if they're server-side rendering apps or front-end applications tightly coupled with their back-end being developed by the same team. Basically, these tools identify potential user actions in your web application and attempt to target the corresponding endpoints with malicious content.
This would be fine, however modern applications are typically written with a single back-end serving multiple front-ends (think: web, mobile, thirt-party integrations) and there are even REST API applications out there with no front-end at all.
To my understanding, most popular web security tools struggle to detect endpoints not explicitly utilized by the web front-end. This includes service endpoints intended to remain private. Ensuring the security of such endpoints often requires, for example, submitting a Swagger definition upfront (that can be outdated itself).
There are tools which try to do something similar like kiterunner (last updated two years ago) but these are not packaged and complete solutions.
Is it possible there are no modern REST API security scanners which could validate e.g. mobile apps REST API back-ends without providing a Swagger file or intercepting the network traffic?
How do you reliably test the security of your REST API apps?
Is there a market for such security tool dedicated to REST API testing, e.g. targeting mobile app developers?
I would be super thankful for your input on how do you approach this subject, whether I am blind or is there really a gap that you see as well and would like to be filled.