API discovery & fuzzing

When it applies

You need the API's real surface before attacking it: hidden endpoints, accepted methods, extra params, and old versions. Complete inventory is where BOLA/mass-assignment/auth bugs surface.

Why it works

APIs expose far more than the client uses; specs, JS, and mobile apps reveal routes, and version drift leaves un-patched endpoints. Enumerating the surface turns guesswork into targeted testing.

Method

1. Harvest from specs/clients: OpenAPI/Swagger (swagger.json, /api-docs), Postman collections, GraphQL introspection, and endpoints in JS bundles / mobile apps.
2. Route brute: kiterunner (API-aware wordlists incl. methods) or ffuf against /api/FUZZ, /v{1,2,3}/; try each with GET/POST/PUT/PATCH/DELETE — method matters.
3. Param discovery: arjun/Burp param miner per endpoint to find hidden inputs (feed mass-assignment, injection, IDOR tests).
4. Version & shadow: enumerate /v1../v3, /internal, /beta; compare behaviour/auth across versions.
5. Feed the results into api-bola, api-mass-assignment, api-auth-attacks, injection.