{"repo":"Aftab700/API-Penetration-Testing","free":true,"listed":false,"github":"https://github.com/Aftab700/API-Penetration-Testing","clone":"git clone https://github.com/Aftab700/API-Penetration-Testing.git","description":"API Penetration Testing Notes","language":null,"stars":19,"topics":["api","api-pentest","api-testing","apisec","apisecurity","notes","api-hacking","api-hacks","api-hardening","api-hunting"],"license":"MIT","category":"api-integrations-sdks","readme_excerpt":"API-Penetration-Testing Web API Indicators lookout for obvious URL naming schemes: - https://target-name.com/api/v1 - https://api.target-name.com/v1 - https://target-name.com/docs - https://dev.target-name.com/rest Look for API indicators within directory names like: /api, /api/v1, /v1, /v2, /v3, /rest, /swagger, /swagger.json, /doc, /docs, /graphql, /graphiql, /altair, /playground Also, subdomains can also be indicators of web APIs: - api.target-name.com - uat.target-name.com - dev.target-name.com - developer.target-name.com - test.target-name.com TruffleHog is a great tool for automatically discovering exposed secrets. - https://github.com/trufflesecurity/trufflehog Active API Reconnaissance - nmap -sV --script=http-enum -p 80,443,8000,8080 - amass enum -active -d target-name.com grep api - The following example uses an API-specific wordlist to find the directories on an IP address: - gobuster dir -u target-name.com:8000 -w /home/hapihacker/api/wordlists/common apis 160 - Kiterunner for discovering API endpoints and resources. - https://github.com/assetnote/kiterunner - kr scan HTTP://127.0.0.1 -w /api/wordlists/data/kiterunner/routes-large.kite Authentication Attacks brute-force attacks: - creating targeted password lists - https://github.com/sc0tfree/mentalist - https://github.com/Mebus/cupp Password Spraying - combining a long list of users with a short list of targeted passwords. JWT Attacks JWT.io is a free web JWT debugger - https://jwt.io/ Automating JWT attacks with","default_branch":null,"files":null,"tree":[],"storefront":"/r/Aftab700","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/Aftab700/API-Penetration-Testing/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}