VOAPI2: a Vulnerability-Oriented Testing Framework for RESTful APIs

With the rapid proliferation of Web services, RESTful APIs have become a fundamental building block of modern software systems. As APIs increasingly expose critical business logic and sensitive data, ensuring their security has emerged as a pressing challenge. However, most existing RESTful API testing tools primarily emphasize functional correctness and robustness, and thus often fail to effectively uncover security vulnerabilities that do not manifest as obvious crashes or server errors.In this paper, we present VOAPI2, a vulnerability-oriented inspection framework for RESTful APIs that explicitly targets security flaws by leveraging the intrinsic relationship between API functionality and vulnerability types [1]. Unlike conventional API fuzzers that explore endpoints indiscriminately, VOAPI2 adopts a guided testing strategy that first identifies security-critical endpoints by analyzing semantic cues in API specifications. Based on these cues, the framework generates vulnerability-specific attack payloads and embeds them into state-aware request sequences that respect API execution dependencies.To accurately determine whether a vulnerability is successfully triggered, VOAPI2 further incorporates a feedback-driven verification mechanism that analyzes API responses and observable side effects rather than relying solely on generic server error codes. We implement a prototype of VOAPI2 on top of an existing stateful API testing engine and conduct a preliminary evaluation on real-world APIs. The results demonstrate that VOAPI2 is capable of discovering security vulnerabilities that are missed by state-of-the-art API testing tools, including previously unknown security issues that were later confirmed by developers. These findings indicate that vulnerability-oriented testing is a practical and effective direction for improving the coverage and efficiency of RESTful API security testing.