API schema drift
The published OpenAPI file and the live API drift apart. Old versions stay mounted. Docs reveal routes the UI never calls. Authorization still has to hold on the route you actually hit.
Tags: api, authz, recon
Level: intermediate
Method
Fetch the schema you are allowed to read
OpenAPI, Swagger, or a GraphQL schema the app already ships. Save it. A schema behind an admin login is not yours unless your role can open it.
Tools: browser
Diff against the UI
List operations the UI never calls. Those are candidates, not findings.
Tools: browser
Replay one live call
Take a request you already captured and compare it with the documented parameters. Extra fields the server accepts are mass assignment only if they change a value you should not set.
Tools: Burp Suite
Old versions
If /v1 and /v2 both answer, run one ownership check on each with objects you own. The older route is the usual miss.
Tools: Burp Suite
Docs versus deploy
A documented admin route that 404s is stale docs. A documented admin route that returns your user's data is the bug.
Tools: Burp Suite
Do not fuzz the schema
This pass is a diff and a single replay. Spraying every operation is a different, noisier job and often out of policy.
Tools: browser
Field notes
- A public schema is recon. The finding is an operation that skips a check.
- Deprecated in the file and still deployed are not the same fact. Test the live host.
- GraphQL persisted queries are the sibling page when the client sends hashes instead of a schema.