Overview
APIs are a major, often under-tested part of the modern attack surface, so discovering them is a key asset-discovery step. This lesson covers API discovery.
Learning objectives
- Explain discovering APIs during asset discovery.
- Describe finding API endpoints and characterizing them.
- Connect API discovery to high-value hunting.
Core concept
APIs are backend interfaces (often REST/JSON) that applications and clients use to read and change data — frequently exposing more functionality than the visible UI and being directly callable. API discovery finds the in-scope APIs, their endpoints, supported methods, and their general surface. Because APIs concentrate data operations and are prone to high-impact flaws (notably broken object-level authorization), discovering and characterizing them is high-value in bug bounty. APIs may be obvious (documented) or hidden (used by client-side code, mobile apps), so discovery looks in multiple places.
How it works
The researcher discovers APIs from several sources: application client-side code (which reveals the API endpoints it calls), any documentation the program provides, observed traffic, and content/endpoint discovery. They characterize the API surface — endpoints, methods, and especially object-referencing endpoints (candidates for authorization testing) and data-changing operations. Hidden APIs (used by front-ends or mobile apps but not documented) are particularly valuable, as they may be less-tested. Discovered APIs, verified in-scope, become high-priority hunting targets, feeding the endpoint-discovery and API-testing modules. As always, discovery respects scope.
Practical example
Discovering assets, the researcher examines an application's client-side code and finds it calls API endpoints like /api/users/{id} and /api/orders — some not documented anywhere public. These object-referencing and data endpoints are high-value: /api/users/{id} is a candidate for broken-object-level-authorization testing. The researcher characterizes the API surface (endpoints, methods) and, verifying it's in-scope, prioritizes it for hunting. The API — larger and less-tested than the visible UI — became a prime target, discovered by inspecting the front-end's calls.
Cybersecurity relevance
API discovery is high-value in bug bounty because APIs are a large, directly-callable, often under-tested surface prone to top-severity flaws (broken object-level authorization and other API risks from the web-security path). Hidden APIs (revealed by client-side code or mobile apps) are especially fruitful. Discovering and characterizing in-scope APIs directs hunting toward high-impact opportunities and sets up the endpoint-discovery and API-testing modules. For defenders, it underscores securing every API endpoint (each needs its own auth/authorization/validation). Thorough, in-scope API discovery is a strong source of valuable findings.
Common mistakes
- Testing only the visible UI, missing APIs that expose more functionality.
- Overlooking hidden APIs revealed by client-side code or mobile apps.
- Not flagging object-referencing endpoints for authorization testing.
Key takeaways
- APIs are directly-callable backend interfaces that often expose more than the UI and are prone to high-impact flaws (esp. broken object-level authorization).
- API discovery finds in-scope endpoints/methods from client-side code, documentation, traffic, and endpoint discovery — including valuable hidden APIs.
- Characterizing the API surface (esp. object-referencing/data endpoints) directs high-value hunting and sets up endpoint-discovery and API-testing; verify scope throughout.
Check your understanding
- Why are APIs (especially hidden ones) high-value discovery targets in bug bounty?
- How can inspecting an application's client-side code help discover its APIs?