API Reconnaissance

# OpenAPI / Swagger
/openapi.json
/openapi.yaml
/swagger.json
/swagger.yaml
/v3/api-docs            # springfox / springdoc default
/v2/api-docs            # older springfox
/api-docs
/api/swagger.json
/api/v1/swagger.json
/api/v2/openapi.json
/docs/openapi.yaml
/docs/api/spec.json
/_api/spec
/_openapi
/spec
/api/v3/spec.yaml

# UI-driven explorers (often unprotected)
/swagger-ui/
/swagger-ui/index.html
/redoc
/redoc/index.html
/api/docs
/docs
/scalar
/rapidoc

# GraphQL playgrounds
/graphql
/graphiql
/playground

# RAML / WSDL legacy
/api.raml
/services?wsdl

# fuzz a curated wordlist of API doc paths
ffuf -u https://api.example.com/FUZZ \
     -w SecLists/Discovery/Web-Content/api/api-endpoints.txt \
     -mc 200,401,403 \
     -fs 0 \
     -t 50 \
     -o spec-discovery.json

# kiterunner (smarter — knows API patterns + verbs)
kr scan https://api.example.com -w routes-large.kite

# or curl all at once
for p in openapi.json swagger.json v3/api-docs api-docs docs/openapi.yaml ; do
  echo -n "$p: "
  curl -s -o /dev/null -w "%{http_code}\n" https://api.example.com/$p
done

# 1. browse the app in a clean browser profile
# 2. DevTools → Network tab → filter: JS
# 3. select all → right-click → "Save all as HAR"
#    OR per-file: right-click → "Save as"

# 4. headless alternative — pull every JS the index references
curl -s https://app.example.com/ \
  | grep -oE 'src="[^"]+\.js[^"]*"' \
  | grep -oE '[^"]+\.js' \
  | while read url; do
      [[ "$url" == http* ]] || url="https://app.example.com$url"
      wget -q -P bundles/ "$url"
    done

# 5. or use a tool that does the SPA-aware fetch (waits for runtime chunks)
katana -u https://app.example.com -d 3 -jc -o crawl.txt
gospider -s https://app.example.com -d 3 -c 10 -t 20 --js

# 1. endpoints — fetch/axios/jquery
grep -rEoh 'fetch\(\s*"[^"]+"' bundles/  | sort -u
grep -rEoh 'axios\.\w+\(\s*"[^"]+"' bundles/ | sort -u
grep -rEoh '\$.\w+\(\s*"[^"]+"' bundles/  | sort -u

# 2. relative URL strings starting with /api or /v\d
grep -rEoh '"[a-zA-Z./-]*?/api/[a-zA-Z./_-]+' bundles/ | sort -u
grep -rEoh '"/v\d+/[a-zA-Z./_-]+' bundles/ | sort -u

# 3. secrets — Stripe keys, AWS, GitHub, Slack tokens
grep -rEoh 'sk_live_[a-zA-Z0-9]{24,}' bundles/
grep -rEoh 'AKIA[0-9A-Z]{16}' bundles/
grep -rEoh 'ghp_[a-zA-Z0-9]{36}' bundles/
grep -rEoh 'xox[bpsa]-[a-zA-Z0-9-]+' bundles/

# 4. config blocks — API_BASE, FEATURE_FLAGS, REGION
grep -rEoh '(apiKey|API_KEY|secret|token|baseUrl|API_BASE)[\s:=]+"[^"]+"' bundles/

# waybackurls — easiest
echo "api.example.com" | waybackurls | sort -u > historical-urls.txt

# more sources at once
echo "api.example.com" | gau --providers wayback,otx,commoncrawl,urlscan > all-sources.txt

# CDX API directly (no tool)
curl -s "http://web.archive.org/cdx/search/cdx?url=api.example.com/*&output=text&fl=original&collapse=urlkey" \
  | sort -u > historical-urls.txt

# common-crawl — bigger / older
curl -s "https://index.commoncrawl.org/CC-MAIN-2024-26-index?url=api.example.com/*&output=json" \
  | jq -r .url | sort -u

# subdomain-aware
echo "*.example.com" | waybackurls

# old API versions
grep -E "/api/v[0-9]+/" historical-urls.txt

# debug / internal / admin / test endpoints
grep -Ei "/(debug|internal|admin|test|qa|legacy|old|deprecated|sandbox)/" historical-urls.txt

# extensions that scream "leftover"
grep -Ei "\.(bak|backup|orig|old|sql|swp|swagger|json\.bak)$" historical-urls.txt

# query params worth re-trying today (admin=true, debug=1)
grep -oE '\?[a-z_]+(=[^&]+)?' historical-urls.txt | sort -u

# probe every candidate against current production
cat candidates.txt | httpx -status-code -follow-redirects -no-color \
  | grep -v "404"

# or curl loop with a sane rate
while read url; do
  echo -n "$url -> "
  curl -s -o /dev/null -w "%{http_code} (%{size_download}b)\n" "$url"
  sleep 0.5
done < candidates.txt

# subfinder — multi-source aggregator
subfinder -d example.com -all -silent -o subs.txt

# amass — passive only
amass enum -passive -d example.com -o subs.txt

# crt.sh — Certificate Transparency logs (every cert ever issued for *.example.com)
curl -s "https://crt.sh/?q=%25.example.com&output=json" \
  | jq -r ".[].name_value" | sort -u

# assetfinder
echo example.com | assetfinder --subs-only

# combine them all
( subfinder -d example.com -silent; \
  amass enum -passive -d example.com; \
  assetfinder --subs-only example.com; \
  curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r ".[].name_value" \
) | sort -u > all-subs.txt

# httpx — alive check, tech detect, status code
cat all-subs.txt | httpx -title -status-code -tech-detect -no-color -o alive.txt

# or with screenshots
cat all-subs.txt | httpx -screenshot -srd shots/

# DNS-only — what resolves vs what doesn't
cat all-subs.txt | dnsx -silent -resp

# basic
for v in v0 v1 v2 v3 v4 v5 internal beta staging dev test old legacy; do
  echo -n "/api/$v/users: "
  curl -s -o /dev/null -w "%{http_code}\n" https://api.example.com/api/$v/users
done

# ffuf — versioned wordlist
ffuf -u https://api.example.com/api/FUZZ/users \
     -w api-versions.txt \
     -mc 200,401,403,500

# Burp Intruder — same idea with full request manipulation

# common paths
/graphql
/api/graphql
/v1/graphql
/v2/graphql
/query
/__graphql
/graphiql       # interactive UI
/playground     # Apollo playground

# detection probe
curl -s -X POST https://api.example.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{__typename}"}'
# {"data":{"__typename":"Query"}}  ← confirmed GraphQL

# minimal
curl -X POST https://api.example.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name}}}"}'

# full standard introspection — too long for here, see:
# https://raw.githubusercontent.com/graphql/graphql-js/main/src/utilities/getIntrospectionQuery.ts

# tools
inql introspect -t https://api.example.com/graphql -o schema.json
graphql-introspection-query  > schema.json
clairvoyance -u https://api.example.com/graphql -w common-words.txt  # if introspection disabled

# Burp + InQL extension automates the whole flow

# render the schema as a graph
graphql-voyager   # open schema.json
graphqlcheck      # security-focused linter

# clairvoyance — brute-force the schema from error messages
clairvoyance -u https://api.example.com/graphql -w common-graphql-fields.txt -o schema.json

# how it works:
#  query { aRandomField }
#  → server: "Cannot query field 'aRandomField' on type 'Query'. Did you mean 'foo, bar, baz'?"
#  → clairvoyance parses the suggestion + iterates
#  often recovers ~80% of the schema even with introspection off

# ffuf — fast, simple
ffuf -u https://api.example.com/FUZZ \
     -w SecLists/Discovery/Web-Content/api/api-endpoints.txt \
     -mc 200,401,403,500 \
     -fs 0 \
     -t 50

# Recurse into discovered directories
ffuf -u https://api.example.com/users/FUZZ \
     -w common.txt -mc 200,401,403 -recursion -recursion-depth 3

# kiterunner — verb-aware, knows API patterns
kr scan https://api.example.com -w routes-large.kite

# kiterunner brute (random GUID-style API paths)
kr brute https://api.example.com -w routes-small.txt

# gobuster
gobuster dir -u https://api.example.com -w wordlist.txt -s "200,401,403" -k

# feroxbuster
feroxbuster -u https://api.example.com -w wordlist.txt -s 200,401,403

# arjun — hidden parameters on a known endpoint
arjun -u https://api.example.com/v1/search -m GET --include="q=test"
arjun -u https://api.example.com/v1/users -m POST -i POST.json

# x8 — alternative with smarter heuristics
x8 -u https://api.example.com/v1/search -w params.txt

# parameth — python alternative
python parameth.py -u https://api.example.com/v1/search

# pull the APK
adb shell pm list packages | grep example
adb shell pm path com.example.app
adb pull /data/app/com.example.app-1/base.apk

# decode it
apktool d base.apk -o decoded/

# search for API endpoints
grep -rEoh 'https?://[^"]+' decoded/ | sort -u
grep -rEoh '/api/v\d+/[^"]+' decoded/ | sort -u

# secrets
grep -rE '(api_key|secret|password)' decoded/

# iOS .ipa is similar:
unzip app.ipa -d app/
strings Payload/example.app/example | grep -E 'https?://'

## API Recon — Acme Corp (example.com) — 2026-05-23

### Targets
- api.example.com           [prod]    nginx + node, JWT auth
- dev-api.example.com       [dev]     no auth ⚠
- staging-api.example.com   [staging] HTTP Basic ⚠
- old-api.example.com       [legacy]  no rate limit ⚠

### Discovered specs
- https://api.example.com/openapi.json  (OpenAPI 3.0.2, 187 endpoints)
- https://staging-api.example.com/v1/swagger.json  (Swagger 2.0, 142 endpoints)

### Notable endpoint surface
- /api/v1/admin/* (12 endpoints) — listed in spec but UI never uses them
- /internal/debug/dumpdb — confirmed live, requires no auth on dev-api
- /api/v0/users — listed nowhere current, still serves 200

### Secrets found in bundles
- Stripe publishable key (public, OK)
- Stripe SECRET KEY (sk_live_…) in admin.chunk.js ☠
- Internal Slack webhook in main.bundle.js

### Versions discovered
prod: v3 (current), v0/v1/v2/beta all live ⚠
staging: v2 only
dev: v3 + experimental v4

### GraphQL
graphql.example.com — introspection ON ☠
mutations exposed: deleteUser, impersonate, runRawSQL ☠

### Next steps for active testing
1. test admin endpoints with normal-user token (BFLA)
2. fuzz /internal/debug/* for SSRF/RCE
3. test the impersonate mutation
4. report sk_live_ Stripe key leak NOW (before further testing)

# environment
export TARGET="example.com"

# subdomains
subfinder -d $TARGET -all -silent > subs.txt
amass enum -passive -d $TARGET >> subs.txt
sort -u subs.txt -o subs.txt

# alive
cat subs.txt | httpx -title -status-code -tech-detect -no-color -o alive.txt

# spec discovery on each alive host
for h in $(awk '{print $1}' alive.txt); do
  for p in openapi.json swagger.json v3/api-docs api-docs graphql; do
    code=$(curl -s -o /dev/null -w "%{http_code}" "$h/$p")
    [ "$code" = "200" ] && echo "$h/$p"
  done
done > specs.txt

# wayback URLs across all subs
for h in $(awk '{print $1}' alive.txt | sed 's|https\?://||'); do
  echo "$h" | waybackurls
done | sort -u > wayback.txt

# JS bundles via crawler
cat alive.txt | xargs -I{} -P 4 katana -u {} -d 3 -jc 2>/dev/null \
  | grep -E '\.js($|\?)' > js-urls.txt

# pull bundles, grep
mkdir -p bundles && cat js-urls.txt | parallel -j 4 wget -q -P bundles/ {}
grep -rEoh '/api/v\d+/[a-zA-Z./_-]+' bundles/ | sort -u > js-endpoints.txt
grep -rEoh 'sk_(live|test)_[a-zA-Z0-9]{24,}' bundles/ > secrets.txt

# ffuf gaps
ffuf -u "https://api.$TARGET/FUZZ" -w api-wordlist.txt -mc 200,401,403 -o ffuf.json

# consolidate
cat js-endpoints.txt wayback.txt ffuf.json | extract_url.py | sort -u > all-endpoints.txt
wc -l all-endpoints.txt