Week Content

Opening Framing: The API-First World

Modern applications are API-driven. Mobile apps, single-page applications, microservices, and third-party integrations all communicate through APIs. This architectural shift creates a vast new attack surface.

APIs differ from traditional web applications. They're designed for machine consumption, often lack the visual context that helps identify functionality, and may expose more direct access to business logic than web interfaces.

This week covers REST API testing, GraphQL security, API authentication mechanisms, and the OWASP API Security Top 10— the unique vulnerabilities that affect programmatic interfaces.

Key insight: APIs often expose the same vulnerabilities as web apps, plus unique ones from their architectural patterns.

1) API Fundamentals

Understanding modern API architectures:

API Types:

REST (Representational State Transfer):
- Most common API style
- HTTP methods map to operations
- Stateless
- Resource-based URLs

GraphQL:
- Query language for APIs
- Single endpoint
- Client specifies exact data needed
- Strongly typed schema

SOAP (Simple Object Access Protocol):
- XML-based messaging
- Strict standards
- Legacy, still in enterprise
- WSDL describes services

gRPC:
- Binary protocol (Protocol Buffers)
- High performance
- Microservices communication
- Less common externally

REST API Conventions:

HTTP Methods → CRUD Operations:

GET    /users         → List all users
GET    /users/123     → Get user 123
POST   /users         → Create new user
PUT    /users/123     → Replace user 123
PATCH  /users/123     → Update user 123 partially
DELETE /users/123     → Delete user 123

URL Patterns:
/api/v1/resources
/api/v1/resources/{id}
/api/v1/resources/{id}/subresources

Response Codes:
200 OK - Success
201 Created - Resource created
204 No Content - Success, no body
400 Bad Request - Client error
401 Unauthorized - Auth required
403 Forbidden - Auth failed
404 Not Found - Resource doesn't exist
500 Internal Server Error - Server bug

API Authentication:

Common API Auth Methods:

API Keys:
X-API-Key: abc123
?api_key=abc123
Simple but often leaked

Bearer Tokens (JWT):
Authorization: Bearer eyJhbG...
Stateless, contains claims
Common in modern APIs

Basic Authentication:
Authorization: Basic dXNlcjpwYXNz
Base64(username:password)
Simple, often over-permissioned

OAuth 2.0:
Authorization: Bearer [access_token]
Delegated authorization
Multiple grant types

HMAC Signatures:
Request signed with secret key
Timestamp prevents replay
More complex, more secure

Key insight: API authentication is often weaker than web authentication. API keys are frequently leaked in code.

2) API Discovery and Documentation

Finding and mapping API endpoints:

API Discovery Methods:

Documentation:
/api-docs
/swagger.json
/swagger/v1/swagger.json
/openapi.json
/v1/api-docs
/docs
/redoc

Common API Paths:
/api/
/api/v1/
/api/v2/
/rest/
/graphql
/query

Discovery from Client:
- Browser DevTools → Network tab
- Mobile app traffic → Proxy
- JavaScript files → API URLs

Swagger/OpenAPI Enumeration:

# Swagger UI often at:
/swagger-ui.html
/swagger-ui/
/api-docs/swagger-ui.html

# OpenAPI specification:
/openapi.json
/swagger.json
/api/swagger.json

# Parse OpenAPI spec for endpoints:
# Contains all routes, parameters, schemas

{
  "paths": {
    "/users": {
      "get": {...},
      "post": {...}
    },
    "/users/{id}": {
      "get": {...},
      "delete": {...}
    }
  }
}

# Tools:
# - Swagger Editor (import spec)
# - Postman (import OpenAPI)
# - Burp OpenAPI Parser extension

API Endpoint Fuzzing:

# Discover undocumented endpoints:

# Directory fuzzing:
ffuf -u https://api.target.com/FUZZ -w api-wordlist.txt

# Version fuzzing:
ffuf -u https://api.target.com/v1/FUZZ -w api-wordlist.txt
ffuf -u https://api.target.com/v2/FUZZ -w api-wordlist.txt

# Parameter fuzzing:
ffuf -u "https://api.target.com/users?FUZZ=value" -w params.txt

# SecLists API wordlists:
/usr/share/seclists/Discovery/Web-Content/api/
  - api-endpoints.txt
  - objects.txt

# Common undocumented endpoints:
/admin
/internal
/debug
/test
/health
/metrics
/status
/config
/env

Traffic Analysis:

# Capture API traffic from applications:

# Web applications:
1. Open browser DevTools
2. Network tab
3. Filter by XHR/Fetch
4. Browse application
5. Note all API calls

# Mobile applications:
1. Configure proxy (Burp)
2. Install CA certificate on device
3. Use mobile app
4. Capture all traffic

# Thick clients:
1. Wireshark or proxy
2. SSL interception may be harder
3. Look for certificate pinning

# Document:
- All endpoints found
- Parameters used
- Authentication method
- Request/response formats

Key insight: API documentation often reveals more than intended. Undocumented endpoints may lack security controls.

3) OWASP API Security Top 10

The top API-specific vulnerabilities:

OWASP API Security Top 10 (2023):

API1: Broken Object Level Authorization
      (BOLA/IDOR - accessing others' objects)

API2: Broken Authentication
      (Weak auth, token issues)

API3: Broken Object Property Level Authorization
      (Mass assignment, excessive data exposure)

API4: Unrestricted Resource Consumption
      (No rate limiting, DoS)

API5: Broken Function Level Authorization
      (Accessing admin functions)

API6: Unrestricted Access to Sensitive Business Flows
      (Abusing business logic at scale)

API7: Server Side Request Forgery
      (SSRF via API)

API8: Security Misconfiguration
      (Verbose errors, CORS issues)

API9: Improper Inventory Management
      (Old API versions, shadow APIs)

API10: Unsafe Consumption of APIs
       (Trusting third-party APIs)

API1: BOLA (IDOR in APIs):

# Most common API vulnerability

# Example:
GET /api/users/123/orders
# Returns user 123's orders

# Attack:
GET /api/users/124/orders
# Returns user 124's orders (BOLA!)

# Testing:
1. Create two accounts
2. Note object IDs for each
3. Try accessing account B's objects with account A's token

# Variations:
GET /api/orders/1001         # Direct object access
POST /api/orders/1001/refund # Action on others' objects
DELETE /api/users/124        # Delete others' resources

# UUIDs don't help:
GET /api/users/550e8400-e29b-41d4-a716-446655440000
# Still vulnerable if no authorization check

API3: Mass Assignment:

# Modifying properties you shouldn't

# Normal request:
POST /api/users
{"name": "John", "email": "john@test.com"}

# Mass assignment attack:
POST /api/users
{
  "name": "John",
  "email": "john@test.com",
  "role": "admin",          # Added
  "isVerified": true,       # Added
  "credits": 999999         # Added
}

# If API binds all properties:
# Attacker becomes admin with unlimited credits!

# Testing:
1. Find object schema (docs, responses)
2. Identify sensitive fields
3. Try adding them to requests
4. Check if values are accepted

# Common targets:
role, isAdmin, permissions
balance, credits
verified, approved
password (change others')

API4: Rate Limiting Issues:

# No limits = abuse opportunities

# Brute force:
POST /api/login (unlimited attempts)

# Resource exhaustion:
GET /api/reports/generate (expensive operation)
POST /api/export (generates large files)

# Data scraping:
GET /api/users?page=1
GET /api/users?page=2
... (enumerate all data)

# Testing:
1. Send many requests rapidly
2. Check for 429 Too Many Requests
3. Test different endpoints
4. Check authenticated vs unauthenticated

# Tools:
# Burp Intruder
# ffuf with high thread count
# Custom scripts

Key insight: APIs often have weaker controls than web UIs because developers assume API clients are trusted.

4) GraphQL Security

Testing GraphQL APIs:

GraphQL Basics:

Single endpoint: /graphql

Query (read data):
query {
  user(id: 123) {
    name
    email
  }
}

Mutation (modify data):
mutation {
  createUser(name: "Test", email: "test@test.com") {
    id
  }
}

# All operations via POST to /graphql

GraphQL Introspection:

# Introspection reveals entire schema!

# Introspection query:
{
  __schema {
    types {
      name
      fields {
        name
        type {
          name
        }
      }
    }
  }
}

# Get all queries and mutations:
{
  __schema {
    queryType {
      fields {
        name
        args {
          name
          type { name }
        }
      }
    }
    mutationType {
      fields {
        name
      }
    }
  }
}

# Tools:
# - GraphQL Voyager (visualize schema)
# - GraphiQL (interactive explorer)
# - Burp: InQL extension

GraphQL Vulnerabilities:

# IDOR in GraphQL:
query {
  user(id: "other-user-id") {
    name
    email
    password  # Might be returned!
  }
}

# Excessive data exposure:
query {
  users {
    name
    email
    password
    ssn
    creditCard
  }
}
# May return sensitive fields

# Nested query DoS:
query {
  user(id: 1) {
    friends {
      friends {
        friends {
          friends {
            name
          }
        }
      }
    }
  }
}
# Exponential database load

# Batch queries:
query {
  user1: user(id: 1) { name }
  user2: user(id: 2) { name }
  user3: user(id: 3) { name }
  # ... enumerate many users in one request
}

GraphQL Injection:

# SQL injection in arguments:
query {
  user(name: "admin' OR '1'='1") {
    name
    email
  }
}

# NoSQL injection:
query {
  user(filter: "{\"$gt\": \"\"}") {
    name
  }
}

# Testing:
# Inject into every argument
# Look for errors revealing backend

Key insight: GraphQL introspection often reveals everything. Disable it in production or test everything it reveals.

5) API Testing Methodology

Systematic approach to API security testing:

API Testing Phases:

1. Discovery
   - Find documentation
   - Capture traffic
   - Enumerate endpoints
   - Identify authentication

2. Analysis
   - Map all endpoints
   - Identify object references
   - Note authentication/authorization
   - Document data flows

3. Authentication Testing
   - Token analysis
   - Session management
   - Brute force protection
   - Token leakage

4. Authorization Testing
   - BOLA/IDOR
   - Function-level access
   - Mass assignment
   - Horizontal/vertical escalation

5. Input Validation
   - Injection attacks
   - Parameter tampering
   - Data type manipulation

6. Business Logic
   - Rate limiting
   - Workflow bypass
   - Resource exhaustion

Testing Tools:

# Burp Suite:
- Proxy for traffic capture
- Repeater for manual testing
- Intruder for fuzzing
- Extensions: InQL, OpenAPI Parser, Autorize

# Postman:
- API collection management
- Environment variables
- Automated testing
- Import OpenAPI specs

# OWASP ZAP:
- API scanning
- OpenAPI import
- Active scanning

# Specialized:
- Arjun: Parameter discovery
- ffuf: Endpoint fuzzing
- jwt_tool: JWT testing
- GraphQL Voyager: Schema visualization

# Command line:
curl -X GET "https://api.target.com/users" \
  -H "Authorization: Bearer token123" \
  -H "Content-Type: application/json"

# httpie (user-friendly curl):
http GET api.target.com/users "Authorization: Bearer token123"

API Testing Checklist:

Authentication:
□ Test without authentication
□ Test with invalid tokens
□ Test expired tokens
□ Test token from different user
□ Check token in URL vs header
□ Test API key exposure

Authorization:
□ BOLA on all object references
□ Mass assignment on create/update
□ Function-level access control
□ Cross-tenant access
□ HTTP method tampering

Input Validation:
□ SQL injection in parameters
□ NoSQL injection
□ Command injection
□ XXE (if XML accepted)
□ SSRF in URL parameters

Rate Limiting:
□ Authentication endpoints
□ Expensive operations
□ Data export features
□ Search functionality

Information Disclosure:
□ Verbose error messages
□ Stack traces
□ Internal IPs
□ Technology versions
□ Sensitive data in responses

Configuration:
□ CORS policy
□ HTTP security headers
□ TLS configuration
□ Old API versions accessible

Key insight: API testing requires methodical coverage. Every endpoint, every parameter, every method.

Real-World Context: API Security Today

API vulnerabilities in practice:

API Breaches: Major breaches have resulted from API vulnerabilities. Exposed GraphQL introspection revealing entire schemas. BOLA allowing access to millions of user records. API keys hardcoded in mobile apps.

Bug Bounty Trends: API vulnerabilities dominate bug bounty programs. BOLA/IDOR is consistently the top finding. GraphQL endpoints often yield multiple issues. Mass assignment provides quick wins.

Security Challenges: API security is hard because APIs expose logic directly. No UI abstraction layer. Every endpoint is an attack surface. Microservices multiply the problem.

MITRE ATT&CK Mapping:

• T1190 - Exploit Public-Facing Application: API exploitation
• T1552 - Unsecured Credentials: API key exposure
• T1119 - Automated Collection: API scraping

Key insight: APIs are the modern attack surface. If you can test APIs, you can test modern applications.

Guided Lab: API Security Testing

Practice API testing on vulnerable targets.