web-pentest
API Security — OWASP API Top 10
REST API penetration testing mapped to the OWASP API Security Top 10 — endpoint/spec discovery, BOLA/BFLA, broken auth, mass assignment & data exposure, resource consumption, SSRF, CORS/misconfig, shadow versions and tooling.
Recon & Discovery (5)
/swagger.json /openapi.json /api-docs /swagger-ui /v2/api-docs
Hunt API docs that map the entire attack surface
ffuf -w api-routes.txt -u https://target.com/api/FUZZ -mc 200,401,403
Brute API routes — 401/403 still reveal hidden endpoints
kr scan https://target.com/ -w routes-large.kite -A=apiroutes
Kiterunner — content discovery tuned for API routes
katana -u https://target.com -jc | grep -Ei '/api/|/v[0-9]'
Crawl and extract API endpoints from JavaScript
try /api/v1 /api/v2 /api/internal /api/private
Version & shadow-API discovery (API9)
API1 / API5 — BOLA & BFLA (3)
swap object IDs across accounts (see the IDOR sheet)
API1 BOLA — read/modify others' objects by changing IDs
call /api/admin/* as a normal user
API5 BFLA — invoke admin-only functions
Burp Autorize to diff low-priv vs high-priv responses
Automate authorization testing across the whole API
API2 — Broken Authentication (4)
no rate-limit on POST /login -> credential stuffing
API2 — brute/stuff when login isn't throttled
hydra -L users.txt -P pass.txt target.com http-post-form "/login:user=^USER^&pass=^PASS^:F=invalid"
Brute the login endpoint
API key in the URL / weak or never-expiring JWT (see JWT sheet)
Token and key weaknesses
password-reset token is guessable or reusable
Account takeover via a weak reset flow
API3 — Mass Assignment & Data Exposure (3)
{"email":"[email protected]","is_admin":true}
API3 BOPLA — inject privileged fields the API binds blindly
diff the JSON response for extra fields (tokens, roles, PII)
Excessive data exposure — the server over-returns
PATCH /api/users/me {"role":"admin"}
Object property-level authorization bypass
API4 — Resource Consumption (3)
?limit=99999999 / ?page_size=1000000
API4 — melt the DB/memory with huge page sizes
no rate-limit on search / export / OTP endpoints
Cost & DoS via unbounded operations
huge JSON body or a deeply nested object
Parser resource exhaustion
API7 / API8 / API9 — SSRF, Misconfig, Inventory (4)
webhook / import-from-URL field -> http://169.254.169.254/ (see SSRF sheet)
API7 SSRF via URL-accepting fields
Origin: https://evil.com -> check Access-Control-Allow-Origin + Allow-Credentials
API8 — permissive CORS leaking authenticated data
OPTIONS / TRACE / verbose stack traces / debug routes
API8 misconfiguration probes
old /api/v1 still live after /api/v2 ships
API9 — deprecated/shadow versions skip new controls
Tooling (3)
nuclei -u https://target.com -tags api,exposure,misconfig
Automated API misconfig/exposure checks
arjun -u https://target.com/api/endpoint -m JSON
Discover hidden JSON parameters
mitmproxy / Postman / Burp to capture and replay the mobile/SPA API
Build the request corpus to fuzz
Related Articles
5
Web Hacking
JSON and YAML Unsafe Deserialization
Deep technical analysis of insecure deserialization across Java, PHP, Python, and Node.js …
Web Hacking
Supply Chain Attacks
Deep technical guide to software supply chain attacks — dependency confusion, malicious np…
Web Hacking
Cross-Site Scripting Mastery
Complete XSS guide covering all attack types, filter bypasses, CSP evasion, cookie stealin…
Web Hacking
File Upload to RCE
Complete file upload exploitation guide — MIME bypass, double extension tricks, polyglot J…
Web Hacking
Advanced SSRF
Complete SSRF exploitation guide — AWS IMDSv1/v2 credential theft, GCP/Azure metadata, bli…
