Testing playbook · intermediate
API Hunting Methodology
Discover, understand, and abuse API surface - usually where the real vulns hide.
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.
Every step requires authorization. Review side effects before running commands against a live system.
Discover endpoints
Pull JS, historical URLs, and Swagger/OpenAPI docs to build the endpoint map.
katana -u https://target.com -jc -silent | anew urls.txt; gau target.com | anew urls.txtEvidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Find hidden parameters
Infer undocumented parameters on interesting endpoints.
arjun -u https://target.com/api/v1/user -oT params.txtEvidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Probe authz per endpoint
Test every endpoint unauthenticated, as a low-priv user, and cross-tenant. BOLA/BFLA are the top API risks.
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Check versioning & docs
Old versions (/api/v1 vs /v2) and exposed Swagger often reveal deprecated, less-protected routes.
ffuf -u https://target.com/api/FUZZ -w api-wordlist.txt -mc 200,401,403Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes
Common guidance
- GraphQL: try introspection, then batch/alias abuse and field-level authz.
- Mass assignment: add extra JSON fields (role, is_admin) and see if they stick.
Related tools
Mapped workflow tools
Sources
References
Version history: normalized permanent page created 2026-08-20.