hacktricks/pentesting/pentesting-web/web-api-pentesting.md

# Web API Pentesting

## Basic Information

Main:

* **Web Services \(SOAP/XML\)**
  * The documentation uses WSDL format and is usually saved in the `?wsdl` path like `https://api.example.com/api/?wsdl`
  * An example of this documentation can be found in [http://www.dneonline.com/calculator.asmx](http://www.dneonline.com/calculator.asmx) \(WSDL document in [http://www.dneonline.com/calculator.asmx?wsdl](http://www.dneonline.com/calculator.asmx?wsdl)\) and you can see an example request calling the `Add` method in [http://www.dneonline.com/calculator.asmx?op=Add](http://www.dneonline.com/calculator.asmx?op=Add)
* **REST APIs \(JSON\)**
  * The standard documentation is the WADL file. Find an example here: [https://www.w3.org/Submission/wadl/](https://www.w3.org/Submission/wadl/). However, there are other more developer friendly API representation engines like [https://swagger.io/tools/swagger-ui/](https://swagger.io/tools/swagger-ui/) \(check the demo in the page\)

## Tricks

### Public and private endpoints

Create a list with the public and private endpoints to know which information should be confidential and try to access it in "unathorized" ways.

### Patterns

Search for API patterns inside the api and try to use it to discover more.  
If you find  _/api/albums/**<album\_id>**/photos/**<photo\_id>**_ ****you could try also things like  _/api/**posts**/<post\_id>/**comment**/_. Use some fuzzer to discover this new endpoints.

### Add parameters

Something like the following example might get you access to another user’s photo album:  
_/api/MyPictureList → /api/MyPictureList?**user\_id=<other\_user\_id>**_

### Replace parameters

You can try to **fuzz parameters** or **use** parameters **you have seen** in a different endpoints to try to access other information

For example, if you see something like: _/api/albums?**album\_id=<album id>**_

You could **replace** the **`album_id`** parameter with something completely different and potentially get other data: _/api/albums?**account\_id=<account id>**_

### Parameter pollution

 /api/account?**id=<your account id>** →  /api/account?**id=<your account id>&id=<admin's account id>**

### Wildcard parameter

Try to use the following symbols as wildcards: **\***, **%**, **\_**, **.**

*  /api/users/\*
* /api/users/%
* /api/users/\_
* /api/users/.

### HTTP requet method change

You can try to use the HTTP methods: **GET, POST, PUT, DELETE, PATCH, INVENTED** to try check if the web server gives you unexpected information with them.

### Request content-type

Try to play between the following content-types \(bodifying acordinly the request body\) to make the web server behave unexpectedly:

* **x-www-form-urlencoded** --> user=test
* **application/xml** -->  <user>test</user>
* **application/json** -->  {"user": "test"}

### Parameters types

If **JSON** data is working try so send unexpected data types like:

* {"username": "John"}
* {"username": true}
* {"username": null}
* {"username": 1}
* {"username": \[true\]}
* {"username": \["John", true\]}
* {"username": {"$neq": "lalala"}}
* any other combination you may imagine

If you can send **XML** data, check for [XXE injections](../../pentesting-web/xxe-xee-xml-external-entity.md).

If you send regular POST data, try to send arrays and dictionaries:

* username\[\]=John
* username\[$neq\]=lalala

### Play with routes

`/files/..%2f..%2f + victim ID + %2f + victim filename`

### Check possible versions

Old versions may be still be in use and be more vulenrable than latest endpoints

* `/api/v1/login`
* `/api/v2/login` 
*  `/api/CharityEventFeb2020/user/pp/<ID>`
*  `/api/CharityEventFeb2021/user/pp/<ID>`

## Owasp API Security Top 10

Read this document to learn how to **search** and **exploit** Owasp Top 10 API vulnerabilities: [https://github.com/OWASP/API-Security/blob/master/2019/en/dist/owasp-api-security-top-10.pdf](https://github.com/OWASP/API-Security/blob/master/2019/en/dist/owasp-api-security-top-10.pdf)

## API Security Checklist

{% embed url="https://github.com/shieldfy/API-Security-Checklist" %}

## List of possible API endpoints

[https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d](https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d)

## Tools

[https://github.com/imperva/automatic-api-attack-tool](https://github.com/imperva/automatic-api-attack-tool): Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.

[https://github.com/flipkart-incubator/Astra](https://github.com/flipkart-incubator/Astra): Another tool for api testing