unauth-api-flow-hijack

name	unauth-api-flow-hijack
description	Exploit unauthenticated multi-step API flows without credentials.
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
platforms	["linux"]
compatibility	Requires curl, python3
tags	["recon","API","unauthenticated","flow","interview","form","upload","export"]
category	recon
related_skills	["api-noauth-hunt","hardcoded-credential-hunt","hunt-write-gap","hunt-idor"]

Unauthenticated API Flow Hijack

Exploit API endpoints that implement a full business workflow (interview, application, checkout, onboarding) without requiring authentication at any step. Unlike simple data exposure, these flows allow an attacker to participate in — and manipulate — the application's core business logic: submitting forms, uploading files, completing transactions, and exporting data. The entire state machine is accessible without credentials.

When to Use

• An API serves a multi-step workflow (start → step1 → step2 → ... → complete).
• No authentication token, session cookie, or API key is required at any step.
• The API returns session identifiers (UUIDs, tokens) that can be reused across steps.
• The workflow includes file upload, data submission, or export functionality.
• Error messages reveal the expected request format (validating that endpoints are live).

Prerequisites

• terminal with curl and python3.
• Discovery of at least one API endpoint that accepts POST without authentication.
• The endpoint returns an identifier (session ID, interview ID, token) that can be passed to subsequent steps.

Quick Detection

# Probe common flow-starting endpoints
for ep in /start /api/start /api/v1/start /begin /init /api/init \
          /start-interview /api/interview/start /api/session/start; do
  code=$(curl --max-time 30 --connect-timeout 10 -sk -o /tmp/resp.json -w "%{http_code}" \
    -X POST "https://target.com$ep" \
    -H "Content-Type: application/json" -d '{}')
  if [ "$code" = "200" ] || [ "$code" = "201" ]; then
    echo "=== $ep ($code) ==="
    cat /tmp/resp.json | python3 -m json.tool 2>/dev/null | head -20
    # Extract any returned ID
     /tmp/resp.json | python3 -c