Understanding API attackers and their methods

In this opening section, we will examine the different methods a would-be attacker can employ to exploit an API, including passive and active traffic interception; finding API keys; fuzzing APIs for endpoints, their methods, and associated passwords; and cracking JSON Web Tokens (JWTs).

Using an appropriate combination of these methods will allow an attacker to launch a successful discovery phase on an API from where further specific attacks can be launched.

Interacting with APIs

APIs are, by their nature, headless; in other words, they do not expose a user interface that can be used to exercise their functionality. An attacker has many methods to interact with an API to discover and exploit weaknesses. Usually, the first step will be to passively examine API traffic using an intercepting proxy (such as Burp Suite) or with an API testing tool such as Postman. The attacker’s goal at this stage is to understand how the API...