Differences between mobile backend APIs and traditional Web: the mobile side usually calls REST APIs directly (without going through a browser), and the authentication mechanisms, parameter formats, and business logic all have mobile-specific characteristics.
⛔ In-depth reference (required reading)
- Payment tampering, verification code bypass, race conditions, data security, mobile-specific issues → references/mobile-logic-bugs.md
Phase 1: API endpoint discovery
# spray 目录爆破（推荐）
spray -u http://target -d /pentest/AboutSecurity/Dic/web/directory/common.txt
# 或 ffuf
ffuf -u http://target/FUZZ -w /pentest/AboutSecurity/Dic/web/directory/common.txt -mc 200,301,302,403
# /api/v1/, /api/v2/, /mobile/api/, /graphql
Check documentation:/docs, /swagger, /openapi.json, /redoc
App reverse engineering: packet capture (Burp/Charles) | APK decompilation to search for URL strings
Phase 2: Authentication mechanism testing
| Authentication method | Characteristics | Attack direction |
|---|---|---|
| JWT | Bearer eyJ... |
jwt-attack-methodology |
| API Key | X-API-Key |
Leak detection |
| OAuth | /oauth/token |
oauth-sso-attack |
| Custom signature | sign=md5(...) |
Signature algorithm reverse engineering |
Bypass testing: access without a Token | expired Token | modify user_id/role | low-privilege access to high-privilege APIs
Phase 3: Business logic vulnerabilities
Privilege escalation (IDOR)
GET /api/v1/users/1001/profile → 自己
GET /api/v1/users/1002/profile → 别人？→ IDOR！
Payment/verification code/race condition
→ Detailed methods and payloads → references/mobile-logic-bugs.md
Notes
- Mobile APIs usually trust the client more than Web does—the backend performs fewer validations
- Pay attention to API version differences (v1 may have vulnerabilities, v2 fixed them but v1 has not been taken offline)