api-enumeration-fuzzing-discovery

Name: api-enumeration-fuzzing-discovery
Author: ShulkwiSEC

18stars5forks

How to install api-enumeration-fuzzing-discovery?

shulkwisec/bb-huge/api-enumeration-fuzzing-discovery

$npx -y skills add ShulkwiSEC/bb-huge --skill api-enumeration-fuzzing-discovery

Installs into the current project.

Summary

Systematically discover hidden Application Programming Interfaces (APIs), uncover undocumented endpoints (Shadow APIs), and fuzz parameters. Use this skill as the pivotal first step in API Bug Hunting, transforming a basic frontend application into a vast mapped attack surface.

Files · 1

View on GitHub

SKILL.md

1	# API Enumeration & Discovery
2
3	## When to Use
4	- When initiating a web application pentest or bug bounty. You must find the APIs powering the frontend React/Vue apps.
5	- When searching for "Shadow APIs" (old `v1/` endpoints developers forgot to turn off).
6	- When seeking undocumented parameters (e.g., hidden `?admin=true` queries) on known endpoints.
7	- When trying to locate API documentation exposed accidentally (Swagger/OpenAPI).
8
9
10	## Prerequisites
11	- Authorized scope and target URLs from bug bounty program
12	- Burp Suite Professional (or Community) configured with browser proxy
13	- Familiarity with OWASP Top 10 and common web vulnerability classes
14	- SecLists wordlists for fuzzing and enumeration
15
16	## Workflow
17
18	### Phase 1: Passive Reconnaissance (API Spying)
19
20	```bash
21	# Concept: Watch the application talk to itself. Modern Single Page Applications (SPAs)
22	# constantly make XHR/AJAX requests to internal APIs.
23
24	# 1. Burp Suite Proxy History
25	# Browse the target site normally for 5 minutes. Filter Burp history for `/api/`.
26	# Document paths like: `api.target.com/v2/users/123/profile`
27
28	# 2. JavaScript Source Analysis (Crucial)
29	# Search the frontend webpack bundles for hidden API routes.
30	# Tool: x8 (or manually using Burp mapping)
31	cat subdomains.txt \| waybackurls \| grep "\.js" \| xargs -n1 curl -s \| grep -oE "api\/[a-zA-Z0-9\/_-]+"
32	```
33
34	### Phase 2: Active Endpoint Brute-Forcing (Fuzzing)
35
36	```bash
37	# Concept: Guess standard, unlinked API endpoints utilizing massive wordlists.
38
39	# 1. Brute-force directories with FFUF (using seclists/Discovery/Web-Content/api)
40	ffuf -w Web-Content/api/api-endpoints.txt -u https://api.target.com/v1/FUZZ -mc 200,401,403
41
42	# 2. Advanced Kiterunner Exploitation
43	# Kiterunner is purpose-built for API discovery, using datasets of actual Swagger routes instead of generic words.
44	kr scan https://api.target.com -w routes-large.kite
45
46	# 3. Find Version Downgrades (Shadow APIs)
47	# If `/v3/users` is secure, check `/v1/users` or `/v2/users`. Older APIs often lack modern authentication.
48	```
49
50	### Phase 3: Hunting for API Documentation (Swagger/OpenAPI)
51
52	```bash
53	# Concept: Developers on Swagger/OpenAPI to document endpoints.
54	# They frequently forget to disable this in production exposing the entire attack surface.
55
56	# Fuzz for common documentation paths using FFUF:
57	ffuf -w swagger-wordlist.txt -u https://api.target.com/FUZZ
58	# Common hits:
59	# /api/docs
60	# /api/swagger/v1/swagger.json
61	# /openapi.yaml
62	# /graphql (GraphQL endpoints often support introspection, returning the whole schema)
63
64	# Action: If you find `swagger.json`, import it directly into Postman or Burp Suite.
65	# You now have the exact required parameters, headers, and methods for EVERY endpoint.
66	```
67
68	### Phase 4: Parameter & Method Fuzzing
69
70	```bash
71	# Concept: Identifying endpoints is half the battle. You must find undocumented "Hidden"
72	# variables that trigger administrative functions.
73
74	# Endpoint identified: POST /api/v1/user/update
75	# Normal param: {"email": "user@test.com"}
76
77	# 1. Parameter Fuzzing via FFUF or Arjun
78	Arjun -u https://api.target.com/api/v1/user/update -m GET
79	# Result: Arjun found hidden parameter `is_admin`.
80
81	# 2. Method Fuzzing (Restful Abuse)
82	# If a GET requests the user, test what a PUT or DELETE does.
83	# A developer might leave a `DELETE /api/v1/users/500` active without authentication.
84
85	# 3. Content-Type Smuggling
86	# Send JSON to an endpoint expecting XML, or XML to one expecting JSON. The parser might crash, revealing stack traces.
87	```
88
89	#### Decision Point 🔀
90	```mermaid
91	flowchart TD
92	A[Discover API Subdomain] --> B[Fuzz for Swagger/OpenAPI Docs]
93	B -->\|Found docs\| C[Import to Postman. Map endpoints.]
94	B -->\|No Docs\| D[Fuzz with Kiterunner/FFUF]
95	D --> E{Identify working endpoints?}
96	E -->\|Yes\| F[Method Fuzzing: GET/POST/PUT/DELETE]
97	F --> G[Parameter Fuzzing: Search for ?admin=true or ?role=dev]
98	E -->\|No\| H[Analyze frontend JS bundles for hardcoded routes]
99	```
100
101
102	## 🔵 Blue Team Detection & Defense
103	- API Gateways: Route all API traffic through centralized API Gateways (e.g., AWS API Gateway, Kong) enforcing strict rate limiting (defending against Kiterunner/FFUF brute-forcing).
104	- Disable Swagger in Production: Explicitly configure CI/CD pipelines to strip `/docs`

People who liked this also viewed

6 picks

Type

api-enumeration-fuzzing-discovery

18stars5forks

View on GitHub

How to install api-enumeration-fuzzing-discovery?

shulkwisec/bb-huge/api-enumeration-fuzzing-discovery

$npx -y skills add ShulkwiSEC/bb-huge --skill api-enumeration-fuzzing-discovery

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# API Enumeration & Discovery
2
3	## When to Use
4	- When initiating a web application pentest or bug bounty. You must find the APIs powering the frontend React/Vue apps.
5	- When searching for "Shadow APIs" (old `v1/` endpoints developers forgot to turn off).
6	- When seeking undocumented parameters (e.g., hidden `?admin=true` queries) on known endpoints.
7	- When trying to locate API documentation exposed accidentally (Swagger/OpenAPI).
8
9
10	## Prerequisites
11	- Authorized scope and target URLs from bug bounty program
12	- Burp Suite Professional (or Community) configured with browser proxy
13	- Familiarity with OWASP Top 10 and common web vulnerability classes
14	- SecLists wordlists for fuzzing and enumeration
15
16	## Workflow
17
18	### Phase 1: Passive Reconnaissance (API Spying)
19
20	```bash
21	# Concept: Watch the application talk to itself. Modern Single Page Applications (SPAs)
22	# constantly make XHR/AJAX requests to internal APIs.
23
24	# 1. Burp Suite Proxy History
25	# Browse the target site normally for 5 minutes. Filter Burp history for `/api/`.
26	# Document paths like: `api.target.com/v2/users/123/profile`
27
28	# 2. JavaScript Source Analysis (Crucial)
29	# Search the frontend webpack bundles for hidden API routes.
30	# Tool: x8 (or manually using Burp mapping)
31	cat subdomains.txt \| waybackurls \| grep "\.js" \| xargs -n1 curl -s \| grep -oE "api\/[a-zA-Z0-9\/_-]+"
32	```
33
34	### Phase 2: Active Endpoint Brute-Forcing (Fuzzing)
35
36	```bash
37	# Concept: Guess standard, unlinked API endpoints utilizing massive wordlists.
38
39	# 1. Brute-force directories with FFUF (using seclists/Discovery/Web-Content/api)
40	ffuf -w Web-Content/api/api-endpoints.txt -u https://api.target.com/v1/FUZZ -mc 200,401,403
41
42	# 2. Advanced Kiterunner Exploitation
43	# Kiterunner is purpose-built for API discovery, using datasets of actual Swagger routes instead of generic words.
44	kr scan https://api.target.com -w routes-large.kite
45
46	# 3. Find Version Downgrades (Shadow APIs)
47	# If `/v3/users` is secure, check `/v1/users` or `/v2/users`. Older APIs often lack modern authentication.
48	```
49
50	### Phase 3: Hunting for API Documentation (Swagger/OpenAPI)
51
52	```bash
53	# Concept: Developers on Swagger/OpenAPI to document endpoints.
54	# They frequently forget to disable this in production exposing the entire attack surface.
55
56	# Fuzz for common documentation paths using FFUF:
57	ffuf -w swagger-wordlist.txt -u https://api.target.com/FUZZ
58	# Common hits:
59	# /api/docs
60	# /api/swagger/v1/swagger.json
61	# /openapi.yaml
62	# /graphql (GraphQL endpoints often support introspection, returning the whole schema)
63
64	# Action: If you find `swagger.json`, import it directly into Postman or Burp Suite.
65	# You now have the exact required parameters, headers, and methods for EVERY endpoint.
66	```
67
68	### Phase 4: Parameter & Method Fuzzing
69
70	```bash
71	# Concept: Identifying endpoints is half the battle. You must find undocumented "Hidden"
72	# variables that trigger administrative functions.
73
74	# Endpoint identified: POST /api/v1/user/update
75	# Normal param: {"email": "user@test.com"}
76
77	# 1. Parameter Fuzzing via FFUF or Arjun
78	Arjun -u https://api.target.com/api/v1/user/update -m GET
79	# Result: Arjun found hidden parameter `is_admin`.
80
81	# 2. Method Fuzzing (Restful Abuse)
82	# If a GET requests the user, test what a PUT or DELETE does.
83	# A developer might leave a `DELETE /api/v1/users/500` active without authentication.
84
85	# 3. Content-Type Smuggling
86	# Send JSON to an endpoint expecting XML, or XML to one expecting JSON. The parser might crash, revealing stack traces.
87	```
88
89	#### Decision Point 🔀
90	```mermaid
91	flowchart TD
92	A[Discover API Subdomain] --> B[Fuzz for Swagger/OpenAPI Docs]
93	B -->\|Found docs\| C[Import to Postman. Map endpoints.]
94	B -->\|No Docs\| D[Fuzz with Kiterunner/FFUF]
95	D --> E{Identify working endpoints?}
96	E -->\|Yes\| F[Method Fuzzing: GET/POST/PUT/DELETE]
97	F --> G[Parameter Fuzzing: Search for ?admin=true or ?role=dev]
98	E -->\|No\| H[Analyze frontend JS bundles for hardcoded routes]
99	```
100
101
102	## 🔵 Blue Team Detection & Defense
103	- API Gateways: Route all API traffic through centralized API Gateways (e.g., AWS API Gateway, Kong) enforcing strict rate limiting (defending against Kiterunner/FFUF brute-forcing).
104	- Disable Swagger in Production: Explicitly configure CI/CD pipelines to strip `/docs`

People who liked this also viewed

6 picks

Type