| name | api-noauth-hunt |
| description | Use when an API may expose data or privileged operations without authentication. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, nmap, python3, masscan, subfinder, httpx, nuclei |
| tags | ["recon","API","no-auth","data-breach","CRUD"] |
| category | recon |
| related_skills | ["firebase-supabase-attack","js-secrets-extraction","port-service-discovery","source-leak-hunt"] |
API No-Authentication Validation
Identify API operations that may be reachable without the authentication or
authorization required by their data and business function. Discovery is
read-only by default. Write validation uses synthetic records and requires
explicit authorization immediately before execution.
When to Use
- Port scan reveals HTTP services on non-standard ports (3000, 5000, 8080-8085, 9000).
- Target has an API subdomain (api.target.com, backend.target.com).
- JavaScript bundles reference internal API endpoints.
- After
port-service-discovery finds HTTP on unexpected ports.
- After
firebase-supabase-attack identifies backend APIs.
Prerequisites
- curl, python3, jq installed.
- Target URL or IP:port of the suspected API.
- List of common API paths for fuzzing.
How to Run
TARGET="https://api.target.com"
for path in "/" "/api" "/api/v1" "/api/users" "/api/health" "/docs" "/swagger.json"; do
code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 --connect-timeout 5 "$TARGET$path")
echo "HTTP $code: $TARGET$path"
done
Quick Reference
| Signal | What It Means | Action |
|---|
HTTP 200 on /api/users or /api/clients | Possible unauthenticated data access | Validate one bounded sample |
| HTTP 2xx on POST without auth | Possible unauthenticated write | Stop and obtain write authorization |
OpenAPI/Swagger at /docs, |
