API Security · beginner · ~10 min

The API attack surface

Explain why APIs differ from web UIs as a testing target and how to enumerate them.

Overview

APIs are the backend's direct attack surface: no UI to guide you, objects exposed by ID, frequent over-trust of the client, and version sprawl. They have their own OWASP API Top 10 (BOLA, BFLA, mass assignment, resource consumption). Enumerate via client traffic, Swagger/Postman, and fuzzing.

Why it matters

Most data and logic now live behind APIs, where authorization bugs dominate and there's no UI to bound what you try. Enumerating the full endpoint map is the prerequisite for testing each one's access control.

Core concepts

No UI bound. Endpoints must be discovered, not clicked. Object-by-ID. Authorization (BOLA/BFLA) is the dominant bug class. Client over-trust. Hand-crafted requests under-checked. Version sprawl. Old endpoints, weaker checks. Enumeration. Client JS/traffic, Swagger/OpenAPI, Postman, fuzzing.

Lesson

Modern apps are mostly APIs with a thin client on top. The API is where the real logic — and the real attack surface — lives.

Why APIs differ from web UIs

  • No guiding UI: the client only ever calls some endpoints; many more exist. There's no page to "click through" — you must discover endpoints.
  • More objects, direct access: APIs expose objects by ID directly, so authorization bugs (BOLA/BFLA) dominate.
  • Trust in the client: APIs often assume the official app is the caller and under-check requests an attacker crafts by hand.
  • Versioning sprawl: /v1/, /v2/, deprecated-but-live endpoints with weaker checks.

OWASP API Top 10

APIs have their own risk list, distinct from the web Top 10. The standouts (covered next): Broken Object Level Authorization (BOLA), Broken Function Level Authorization (BFLA), mass assignment, and unrestricted resource consumption (rate limiting).

Enumerating an API

  • Read the client's JS and mobile app traffic to learn endpoints.
  • Find Swagger/OpenAPI docs and Postman collections (often exposed).
  • Fuzz paths and parameters (ffuf) and try other HTTP methods/versions. The goal is a complete map of endpoints, parameters, and the objects each touches — then test authorization on every one.

Summary

APIs expose the backend directly, with no UI to constrain testing and objects reachable by ID — so authorization flaws lead the OWASP API Top 10. The first job is enumerating every endpoint, parameter, and object to test.

Practice with these exercises