hunt-fastapi

name	hunt-fastapi
description	Hunt FastAPI-specific vulnerabilities: dependency injection gaps, Pydantic coercion, and OpenAPI mining.
category	redteam
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
platforms	["linux"]
compatibility	Requires curl, python3
tags	["redteam","fastapi","Python","ASGI","Pydantic","OpenAPI","dependency-injection"]
related_skills	["hunt-sqli","hunt-api-misconfig","hunt-idor","web-enumeration"]

FastAPI Security Hunting

Hunt FastAPI-specific vulnerabilities in dependency injection authorization gaps, Pydantic model coercion and extra field exploitation, OpenAPI schema mining for hidden endpoints, and ASGI middleware bypasses. FastAPI's design — dependency injection for auth, Pydantic for validation, OpenAPI auto-generation — creates unique attack surface distinct from Flask or Django.

When to Use

• Target uses FastAPI (indicated by /docs, /redoc, /openapi.json, or server: uvicorn).
• OpenAPI schema is publicly accessible.
• API uses dependency injection (Depends) for authorization.
• WebSocket endpoints exist alongside REST API.
• Application uses Pydantic v1 or v2 for request validation.

Quick Detection

# FastAPI fingerprinting
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/openapi.json" | jq '.info.title' 2>/dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/docs" -w "%{http_code}\n" -o /dev/null
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/redoc" -w "%{http_code}\n" -o /dev/null

Procedure

Phase 1 — OpenAPI Schema Mining

# Download full schema for endpoint discovery
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/openapi.json" | jq '.paths | keys[]'

# Find hidden endpoints not in docs
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/openapi.json" | jq '.paths | to_entries[] | select(.value.get != null and .value.get.security == []) | .key'

# Discover internal endpoints via path parameter fuzzing
ffuf -u "https://target.com/api/FUZZ" \
  -w /path/to/wordlist.txt \
  -mc 200,401,403 \
  -H "Accept: application/json"

Phase 2 — Dependency Injection Authorization Gaps

# Depends vs Security — check if auth is actually enforced
curl --max-time 30 --connect-timeout 10 -sk      
curl --max-time 30 --connect-timeout 10 -sk  \
  -H          



 method  GET POST PUT PATCH DELETE; 
  curl --max-time 30 --connect-timeout 10 -sk -X   \
    -w  -o /dev/null



curl --max-time 30 --connect-timeout 10 -sk -X POST  \
  -H  \
  -d