| name | hunt-api |
| description | API attack hunting (REST / GraphQL / gRPC) - BOLA/IDOR, BFLA, mass assignment, excessive data exposure, auth/JWT, introspection + batching, rate-limit abuse. OWASP API Top 10. Wiki-first, FIND schema output. |
Hunt: API Security
Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.
Wiki
qmd_query "API REST GraphQL gRPC BOLA BFLA mass assignment excessive data exposure OWASP API Top 10" via wiki-search MCP
Hub: [[web-moc]] (live web index). Primary page: [[api-security]]. Payload arsenal: wiki/payloads/api.md.
Anchors: [[api-testing]], [[graphql-attacks]].
Variants: [[grpc-web-attacks]] (gRPC-Web / protobuf transcoder abuse), [[rsql-injection]] with the [[rsql]] payload (RSQL/FIQL filter-query injection, e.g. Spring Data REST), [[rate-limit-bypass]] (header/race/distributed-source throttle bypass), [[redos]] payload (catastrophic-backtracking regex DoS in an input validator), [[jwt-attacks]] (token flaws).
For object-level authorization (BOLA/IDOR) see hunt-idor.
Attack surface signals
/api/, /v1/, /graphql, /rest/, gRPC (application/grpc, HTTP/2), Swagger UI (/swagger, /api-docs, /openapi.json), mobile/SPA backends.
Rank before testing. Not all surface is equally likely to be broken:
- Undocumented endpoints present in the spec (Swagger/introspection) but never called by the UI - the classic BFLA surface; nobody tested the route the client does not exercise.
- GraphQL introspection and the mutations/fields it reveals that the client never invokes.
