FastAPI Attack Probe

Authorized probe of a FastAPI 0.100+ app the user owns. Follow shared probing conventions — discover base URL from env (UVICORN_PORT, PORT), pyproject.toml task definitions, Dockerfile EXPOSE, or default uvicorn 8000. Never hardcode.

FastAPI-specific attack surface

• /docs and /redoc are public by default — they expose the full route inventory and request schemas.
• /openapi.json is the most efficient enumeration target — fetch it once and you have every route, method, parameter type, and security requirement.
• Depends/Security is opt-in per route. A single missing Depends(get_current_user) on a mutating route is "anonymous admin" by default.
• Pydantic v2 default extra='ignore' silently drops unknown fields; combined with response models it can leak fields not declared in the request schema.
• JWT verification misconfig is endemic in FastAPI tutorials (jwt.decode without algorithms=).

Procedure

1. Authorization preflight + base URL discovery.
2. Fetch the OpenAPI spec once: GET /openapi.json (also try /api/openapi.json, /v1/openapi.json). Use it to drive the rest of the scan.
3. Probe per rule table.

Rules