Active Discovery:
□ Vespasian: Headless browser crawling → Automatically generate OpenAPI 3.0 / GraphQL SDL specifications
□ Entropy --discover: Extract endpoints from robots.txt + JS files
□ Kiterunner / ffuf: Bruteforce undocumented endpoint paths
□ Check common paths: /swagger.json, /openapi.json, /graphql, /api-docs

GraphQL Introspection (Three-level Attempt):
  1. Standard introspection query
  2. Simplified query (bypass WAF full-block)
  3. Only query __schema { types { name } } (minimal detection)

JWT Analysis (jwt_tool / Burp):
□ alg:none attack: Modify header to "alg":"none", clear signature
□ Key confusion: RS256 public key → HS256 symmetric key
□ Weak HMAC key brute-force: jwt_tool -C -d wordlist.txt
□ Expiration/claim tampering: Modify exp/iat/sub/role claims
□ kid injection: ../../etc/passwd → HMAC signature bypass

OAuth 2.0:
□ redirect_uri manipulation → Authorization code leakage
□ CSRF via missing state parameter
□ Token leakage in Referer header
□ PKCE absence detection

GraphQL Authentication:
□ mutation bypasses authentication via GET request (CSRF)
□ Batch query authentication bypass

BOLA (Object-level Authorization Bypass):
□ Numeric ID traversal: /user/1 → /user/2 → /user/3
□ UUID traversal
□ Username/email traversal
□ Burp Autorize: Dual-session replay comparison

BFLA (Function-level Authorization Bypass):
□ Regular user executes admin API
□ HTTP method switching: GET → PUT → PATCH → DELETE
□ API version downgrade: /v2/admin → /v1/admin
□ Batch operation injection: {"users": [1,2,3]} → {"users": [1,2,3,admin_id]}

Tools: Burp Autorize, AuthMatrix, Entropy (malicious_insider persona)

Introspection leakage → Information exposure detection
Alias overload → 100+ aliases DoS
Batch queries → 10+ concurrent queries DoS
Field repetition → __typename × 500
Directive overload → Recursive @skip/@include
Loop queries → Deep nested introspection recursion
Field suggestions → Error message information leakage
GraphiQL/Playground exposure → IDE public risk
GET mutation → CSRF risk
Tracing/debug mode → Metadata leakage

Tools: FireTail, Escape DAST, api.sh (Phases 1-3)

□ HTTP method switching: GET→POST→PUT→DELETE→OPTIONS→PATCH
□ Content-Type tampering: JSON→XML→multipart
□ NoSQL injection: {"username": {"$gt": ""}}
□ SSRF via URL parameters: webhook URL/avatar URL/import URL
□ XXE in XML endpoints
□ Parameter pollution: /api?role=user&role=admin
□ Mass assignment: Add is_admin: true to request body

□ Entropy compare: diff v1 vs v2 API → Status code changes/field deletion/latency regression
□ Multi-role workflow testing: admin/user/readonly permission matrix
□ Coupon/point/price manipulation
□ Race conditions: Concurrent request testing for TOCTOU

□ Endpoint discovery
□ Message injection (inject payload, prototype pollution)
□ Oversized message handling
□ Type confusion
□ Cross-Site WebSocket Hijacking (CSWH)

□ Rate limit bypass via headers: X-Forwarded-For, X-Real-IP
□ Path variants: /api/ → /api → /Api/ → /API/
□ Slowloris low-bandwidth exhaustion
□ GraphQL batch query deep nesting DoS
□ IP rotation testing (ProxyCat proxy pool)

□ Excessive response exposure: Compare API returns vs UI display
□ Pagination enumeration: ?page=1&limit=10000
□ Error message information leakage: Stack traces/internal paths/SQL errors
□ GraphQL nested traversal for unauthorized data access
□ OpenAPI specification exposing sensitive endpoints

□ Entropy --ci --watch: Automatically re-run when spec changes
□ Escape DAST: Automatically block builds by severity threshold
□ Persist discoveries as regression tests
□ StackHawk (developer-first, ZAP core)