画布 1
API Pentesting
Mindmap
{{Recon}}
  Reconnaissance
    API Version Discovery
      V1
      V2
      V3
      etc
    API Implementation Discovery
      Product / open source
      Custom API Implementation
    API Type Discovery
      RESTful [Most common]
      SOAP [Very rare]
      GraphQL [Newcomer]
    API Documentations
      Local
        WADL for RESTful API
        WSDL for SOAP API
        etc
      Public
        Any public documentation for API like the open source APIs
    HTTP Methods Discovery
      GET
      POST
      PATCH
      PUT
      DELETE
    Endpoints gathering through local docs
      WADL
      WSDL
      etc
    Authentication &
Authorization
      the endpoints which requires authentication and other publicly accessible.
      Authentication / Authorization methods
        Cookie based (non-standard)
        Header based (standard)
      Identification handlers
        JWT (JSON Web Token)
        Encrypted value
        Arbitrary value to save the user's state
        Encoded Serialized value
        Encrypted Serialized value
        Hashed user value
          e.g: hashed username, user ID
    Comparing docs
      Compare the local & public API documentations seeking for hidden functions, methods or endpoints.
    API Fuzzing
      Endpoints
      Actions AKA Methods
      Objects
    Behavior mapping
      Mapping the API's request & response body and headers.
      Identify the job of every API method
[It's vary from API to another]
    API Visualization tools / interfaces discovery
      Swagger API
      Custom Implementations
      etc
  Weaponizing
    Postman
      Import the API environment, documentation and collections
      Link BurpSuite proxy with Postman
      Activate the API environment
      Discovering authentication systems, server's headers and requests parameters body
      Identifying authentication's endpoints.
        OTP
        login
        etc
      Analyzing JS code, like the JSON in the Tests tab
    SoapUI
      Importing WADL / WSDL file initially or using the Application's URL
      Analyze endpoint behaviors using the endpoint explorer
      Link BurpSuite proxy with Postman
    BurpSuite
      Intercept and monitor every request / response
      Run the content discovery on the API seeking for additional endpoints, actions and objects
      Analyze request & response headers and parameters
      Manipulate the request headers and monitor the server's actions to the manipulations
      Run the JavaScript scans to analyze JavaScript files in order to understand the API infrastructure
    Fuzzing
      Fuzzing points
        Endpoints
        Objects
        Methods / Actions
      Tools
        FFUF
          Link it with Burp in order to extend your sitemap range
        BurpSuite Intruder
        Arjun
          Link it with Burp in order to extend your endpoints parameter range
(Vary from target to another)
          Analyze the arjun output to check for the possible vulnerable parameter
    Wordlists
      SecLists
      FuzzDB
      Generating Custom Wordlist
        Using wayback machine
        Using the API docs
        Source Code Reviewing
          e.g: JavaScript
        Organization's github repository if exists
        The source code of API product
- if it was open source -
  Enumeration
    RESTful API enumeration
      Enumerate resources
        e.g: /api/{{products}}/122/edit
      Enumerate objects
        e.g: enumerate object identifiers: /api/users/{{1}}/edit
      In this phase you should concentrate more in the response headers, response length and application's behaviors
    GraphQL API enumeration
      Introspection query enumerating
        Could be found in PayloadAllTheThings
        Our aim of making this is to retrieve
every query that can be run in the database and it's parameters
      Visual representation tools
        GraphQL Voyager
        It will show us the visual representation of GraphQL which made use able to analyze the GraphQL in a deep and accurate way
    Tools
      Kiterunner
        API scanner for endpoints and content discovery.
      unfurl
        Extracting paths from URL lists, this will help in generating custom wordlists phase.