api-fuzz

API security testing methodology

⛔ In-depth reference (required reading)

• Authentication bypass techniques, parameter injection, Mass Assignment, request smuggling → references/api-attack-techniques.md
• 403/405 bypass (resource suffix fuzz dictionary, POST empty JSON, Vue Hash routing, prefix discovery) → references/403-bypass-patterns.md
• Endpoint semantic analysis, RESTful CRUD inference, parameter discovery, intelligent Fuzz, permission boundary testing, response analysis → references/api-semantic-fuzz.md
• Fuzz payload templates classified by parameter semantics (ID/query/file/amount/command/Header) → references/api-fuzz-payloads.md

---

Phase 1: API discovery and documentation

Endpoint discovery

Key paths:/api/, /v1/, /v2/, /graphql, /rest/

Documentation leakage (largest information source)

• /docs, /swagger, /swagger-ui, /swagger-ui.html
• /api-docs, /openapi.json, /openapi.yaml

Framework identification

Framework	Characteristics	Common issues
Spring Boot	/actuator endpoint	Actuator information leakage, SpEL injection
Express/Koa	X-Powered-By: Express	Prototype chain pollution
FastAPI	/docs auto-generated	Swagger enabled by default
Django REST	/api/?format=json	Serializer over-exposure
Laravel	JSON API + PHP	Mass Assignment

Phase 2: Authentication testing

API 端点已确认？
├─ 去掉认证头 → 未认证访问？
├─ IP/路径/方法绕过 → [references/api-attack-techniques.md](references/api-attack-techniques.md)
├─ JWT → 参考 jwt-attack-methodology
└─ OAuth → 参考 oauth-sso-attack

Phase 3: Semantic analysis and intelligent Fuzz

After obtaining the endpoint list, first analyze each endpoint'sbusiness meaning, do not blindly run dictionaries.

RESTful CRUD inference

Discover GET /api/users/123 → infer POST(create)/PUT(update)/DELETE(delete)/PATCH(Mass Assignment) endpoints

Path semantics→testing direction (key quick reference)

Endpoint keyword	Testing direction
users/{id}, order/{id}	IDOR enumeration
search, query, q=	SQL injection, XSS
upload, import	File upload bypass
proxy, url=, redirect	SSRF, open redirect
template, render	SSTI
exec, run, cmd	Command injection
pay, amount, price	Amount tampering (negative/zero/extremely large value)
admin, manage, config	Unauthorized access (highest priority)

→ Complete semantic analysis methods (parameter discovery, Content-Type variants, response analysis, IDOR batch verification, permission boundary testing) → references/api-semantic-fuzz.md → Fuzz payload templates for each type of parameter → references/api-fuzz-payloads.md

Phase 4: Specialized testing entry points

Vulnerability type	Focus points
IDOR (unauthorized access to others' data)	Enumerate ID/UUID, compare responses of different users
GraphQL specialized	Introspection/injection/permission bypass
CSRF (cross-site induced action execution)	Token validation, SameSite, Referer check
CORS (cross-origin data reading)	Origin whitelist, credentials mode

Phase 5: Other tests

Prototype Pollution / Node.js-specific

• __proto__ / constructor.prototype — pollution payload
• Exploit chain: eval, template injection (SSTI), server-side JS execution

Request smuggling

• references/api-attack-techniques.md

Path parsing differences

• Frontend-backend inconsistency or proxy layer differences can bypass authentication
• Path variants:/api/admin/.、trailing dot、/api/admin/..;/public

Notes

• APIs usually use JSON, set Content-Type: application/json
• Error messages are more detailed than Web—an important source of information leakage
• API version differences (v1 may have vulnerabilities but v2 fixed them, v1 is not decommissioned)
• Run semantic analysis first, then fuzz; don't blindly send requests and waste time
• Administrative endpoints (/admin/, /manage/) have the highest priority
• Immediately after confirming each vulnerability evidence_save + report_vuln