This involves attempting to uncover API vulnerabilities with application attacks such as XSS, SQL injections, code injections, and backdoors. Once those vulnerabilities are uncovered, exploiting them with privilege escalations, data stealing methods, and traffic interceptions are part of the Gaining Access scope, as well as assessing the damage that API vulnerability could cause.