Foundations of Attacking APIs

In this chapter, the focus turns to the foundational issues associated with attacking APIs. Firstly, we will understand the different ways that an attacker can exploit an API using methods that include passive monitoring (discovery) and active interception, including the modification of requests and responses. We will then focus on a selection of the most important tools available to an aspiring API attacker and demonstrate how these can be used to perform core attacks, such as cracking passwords or tokens. Finally, we will combine this knowledge to build our own hacking laboratory and commence attacking some popular vulnerable APIs.

This chapter will equip you with the foundational knowledge used by API hackers—there are a vast array of tools and techniques available to a budding attacker, and it is important to know the relative value of different tools and techniques for a given attack scenario.

In a nutshell, this chapter is going to cover...

Technical requirements

For this chapter, you will need a development machine capable of the following:

• Running Docker locally
• Running VS Code with various marketplace extensions
• Access to the internet and a GitHub account to access the examples

This chapter contains many code samples in various languages; these can either be run locally, which will require the installation of compilers, SDKs, and frameworks, or from within a Docker build container.

The example code and various breaking changes to the instructions can be found in the Chapter 5 folder on the book’s GitHub repository here: https://github.com/PacktPublishing/Defending-APIs/tree/main/Chapter5

Understanding API attackers and their methods

In this opening section, we will examine the different methods a would-be attacker can employ to exploit an API, including passive and active traffic interception; finding API keys; fuzzing APIs for endpoints, their methods, and associated passwords; and cracking JSON Web Tokens (JWTs).

Using an appropriate combination of these methods will allow an attacker to launch a successful discovery phase on an API from where further specific attacks can be launched.

Interacting with APIs

APIs are, by their nature, headless; in other words, they do not expose a user interface that can be used to exercise their functionality. An attacker has many methods to interact with an API to discover and exploit weaknesses. Usually, the first step will be to passively examine API traffic using an intercepting proxy (such as Burp Suite) or with an API testing tool such as Postman. The attacker’s goal at this stage is to understand how the API...

Mastering the tools of the trade

APIs are, by their nature, not exposed directly to the end user; rather, they are consumed via a mobile or web application, or perhaps via another API. To attack an API, we need to use a client and/or an interception tool, as discussed in the Interacting with APIs section.

The choice of tools is largely a personal one and my advice to you would be to choose one client (a command-line interface (CLI) such as curl or a GUI such as Postman) and one interception tool (such as Burp Suite) and become familiar with their usage across several scenarios.

CLI clients (HTTPie/cURL)

The simplest API client is a CLI client designed to be run interactively at a command prompt or terminal. They are particularly useful when testing connectivity to APIs or doing simple, quick debugging at the command line.

Most Unix-based OSs will come with either cURL (https://curl.se/) or wget (https://www.gnu.org/software/wget/) pre-installed or readily available from...

Learning the key skills of API attacking

The best way to learn how to hack APIs is by getting hands-on experience with hacking tools and a vulnerable API. We will start by building our own API hacking laboratory using many of the popular tools we have explored, and then use this laboratory to attack some deliberately vulnerable API-based applications. This hands-on approach will equip you with the skills necessary to attack real-world APIs in the upcoming chapters.

Building a laboratory

The choice of a personal laboratory is somewhat dependent on individual preferences for OSs and favored tools. For most users, I would recommend three core components: a versatile modern editor (such as Visual Studio Code), a container runtime environment (such as Docker), and the ubiquitous Kali Linux hacking OS.

Visual Studio Code

The choice of a code editor and/or integrated development environment (IDE) is a deeply personal one (as anyone who remembers the vi versus emacs debates of...

Summary

We have covered a lot of ground in this chapter, and you are well placed to begin the next step of our journey—discovering and attacking APIs. The first consideration when attacking an API is how to interact with it (usually via a reverse proxy), followed by gathering metadata about the API, including keys, tokens, and endpoints.

We learned how API hackers are spoilt for choice when it comes to tools to use against APIs. By far the most important of these are the Postman API browser and the Burp Suite security testing tool. Finally, we covered several excellent educational resources available to API hackers.

Let’s dive into the next exciting chapter in our journey—looking at how to discover APIs.

Further reading

• The best guide to API security resources: https://github.com/arainho/awesome-api-security
• Awesome Burp Suite extensions are available here: https://github.com/snoopysecurity/awesome-burp-extensions
• Assorted API security training courses and playlists:
  • https://www.youtube.com/playlist?list=PLbyncTkpno5HqX1h2MnV6Qt4wvTb8Mpol
  • https://www.wallarm.com/what/how-to-hack-api-in-60-minutes-with-open-source
  • https://hackanythingfor.blogspot.com/2020/07/api-testing-checklist.html
  • https://www.wallarm.com/what/how-to-hack-api-in-60-minutes-with-open-source
• Articles from Approov.io on how to perform MitM attacks on mobile applications:
  • https://approov.io/blog/how-to-mitm-attack-the-api-of-an-android-app
  • https://approov.io/blog/securing-https-with-certificate-pinning-on-android