API Bug Hunting
Methodology
Become a Successful
Bug Bounty Hunter
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
API – What is it?
• Application Programming Interface
• An API, or application programming
interface, is a set of protocols, routines,
and tools for building software
applications that specify how different
software components should interact
with each other.
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
API – Types
• SOAP / XML API
• RESTful API (JSON)
• GraphQL API
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
API - General
• Typical API paths:
• /api/getuser
• /api/getshippingaddress
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
API – How to find them?
• Find API endpoints
• API Documentation
• Javascript files!
• Fuzzing / Scanning
• Test every feature on the web app
• search for /api/
• site: example.com inurl:api
• /api/
• api.example.com
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
API – Older versions
You will often see a version number on
API queries, such as /api/v2.0/execute or
even as a parameter, /api/getuser?v=2.0.
Try OLDER versions to see what's changed
in older versions!
/api/v1.0/
/api/getuser?v=1.0
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
API – IDORs
• IDORs
• Very common in APIs
• Look for ID, GUID, GUUID etc.
• Mobile Apps
• Web Apps
• Mobile and Web App code often
different! Different Vulnerabilities!
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
API – CORS
• Misconfigured CORS
• Provide Origin: yourdomain.com
in the request
• Look for
Access-Control-Allow-Origin:yourdomain.com
in the response.
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
API – SQLi
• SQL Injection
• See SQLi lesson
• Same issues found in APIs
• Sample payload: sleep(10)
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
API – Broken Access Control
Broken Access Control
POST /api/updateuser
{"bio":"example"}
replace JSON with
{"bio":"example","role":"admin"}
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
API – Admin endpoints
• Admin API endpoints accessible by
non-Admin
• /api/adminedit
• Test with low privileges
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
Thank You!
Become a Successful
Bug Bounty Hunter
This presentation uses a free template provided by FPPT.com
www.free-power-point-templates.com
