PSD2 client implementation

Uvođenjem revidirane direktive o platnim uslugama, banke su morale otvoriti svoje sustave trećim pružateljima platnih usluga. S obzirom na to da banke rukuju s izrazito osjetljivim podacima, potrebno je posebnu pozornost obratiti na sigurnost API-ja. Kako bi se to osiguralo, API je potrebno temeljito testirati. Kako bi se implementirao alat proučavalo se Erste PSD2 XS2A sučelje, sve komponente HTTP zahtjeva te česte ranjivosti aplikacijskih programskih sučelja. Nakon toga se u radu razvio alat namijenjen za automatizirano testiranje i provođenje napada nad REST API-jima. Uz standardne komponente potrebne za testiranje API-ja, razvijene su i komponente koje olakšavaju testiranje bankovnih PSD2 XS2A sučelja. Na kraju su, uz pomoć implementiranog alata, implementirani testovi i napadi na probnoj instanci Erste PSD2 XS2A sučelja.With the introduction of the revised Payment Services Directive, banks had to open their systems to third party payment service providers. Given that banks handle extremely sensitive data, special attention needs to be paid to the security of APIs. To ensure this, the API needs to be thoroughly tested. In order to implement the tool, the Erste PSD2 XS2A interface, all components of HTTP requests, and common vulnerabilities in application programming interfaces were studied. After that, a tool intended for automated testing and execution of attacks on REST APIs was developed. In addition to the standard components required for API testing, components have been developed to facilitate testing of banking PSD2 XS2A interfaces. Finally, with the help of the implemented tool, tests, and attacks on the test instance of the Erste PSD2 XS2A interface were implemented