Discovering APIs

In the previous chapter, we explored the foundations of attacking APIs, focusing on many of the tools that attackers use. In this chapter, we’ll use these skills to learn how to discover APIs in the real world. We will learn how to discover APIs using passive methods (where we do not interact with the API directly) and active methods (where we interact with the API directly). We will also learn how to find details of how the API is implemented and how to use this knowledge to attack an API.

For an API defender, it is important to understand the techniques used by your adversaries in discovering your APIs so that you can implement defensive measures to prevent easy discovery and further analysis. In particular, defenders should pay attention to attackers’ techniques in identifying implementation details and use this knowledge to harden their implementations.

For an API attacker, a thorough reconnaissance process provides useful information about...

Technical requirements

For this chapter, you will need a development machine capable of the following:

• Running Docker locally
• Running VS Code with various marketplace extensions
• Access to the internet and a GitHub account to access the examples

This chapter contains many code samples in various languages; these can either be run locally, which will require the installation of compilers, SDKs, and frameworks, or from within a Docker build container.

The example code and various breaking changes to the instructions can be found in the Chapter 6 folder on the book’s GitHub repository here: https://github.com/PacktPublishing/Defending-APIs/tree/main/Chapter6

Passive discovery

In the first section of this chapter, we will investigate various methods of the passive discovery of APIs. Not surprisingly, the techniques involve utilizing different search engines or online repositories to mine useful API metadata.

The finer details of a passive discovery phase will be determined by the target in mind. Sometimes the intent will be to search far and wide (for example, try and identify all APIs that an organization owns) and gain as much information as possible about the number of exposed targets available on the public internet. For example, let’s imagine you are attempting to exploit the API of a new router with a vulnerability—in this case, you will probably be attempting to find online instances with public IP addresses.

In other scenarios, you may know about a particular exploit and want to gain a deeper knowledge of using the exploit in practice. You might use a more narrow and deep strategy (for example, identify only...

Active discovery

We will now look at various techniques for the active discovery of APIs in the real world. By active, we mean that we will interact with the API and/or its network by monitoring the traffic or directly accessing the API or its host.

Note – ensure that you have permission to access the computing resources

The use of active discovery using the tools and techniques described in this section may be against the terms and conditions of use of various services, ranging from your ISP to the relevant cloud hosting service. If you are unsure whether you are authorized to perform such scanning, you should err on the side of caution and seek explicit permission. In many cases, such scanning may also be against the applicable laws within your country, and any violations may have serious consequences. Fortunately, many of the scenarios described can easily be recreated in a laboratory environment that is totally under your control.

Network discovery and scan

Typically...

Implementation analysis

Finally, we will conclude this chapter with some tips on how to glean additional information about the implementation of the API’s server, including the host OS and the libraries and frameworks used, including version numbers. Such information can be immensely useful when attempting to reverse-engineer an API.

Verbose error and debug messages

The first category is the now infamous (due to the high instances of information leakage via this method) error category of excessively verbose error and debug messages. Application developers include various levels of diagnostic information to aid in the debugging of applications in the field. Users can capture the log and send it to the support team for analysis. Unfortunately, such logging can be overly verbose and, along with useful debug information, can also divulge the specifics of the inner workings of the application and details of the implementation.

As an example, consider the commonly encountered...

Summary

This chapter took us on a complete journey from zero knowledge of a target right through to being able to determine the version of the database used. The passive reconnaissance techniques principally used Google and the query operators, as well as the Shodan database, to determine a range of likely candidate targets for exploration.

We learned how to use active reconnaissance to actively focus on the API implementations on the hosts by examining their behavior under live probing using nmap or Massscan, while OWASP ZAP can provide a wealth of insight using spider scanning. Finally, we learned how to use information leakage to gain insight into the inner details of the implementation, allowing us to understand details such as the host OS and database.

By conducting a thorough discovery phase, you will have placed yourself in a perfect position to move on to the final chapter in the section—on attacking APIs.

Further reading

Further reading on discovering APIs:

• https://nordicapis.com/13-api-directories-to-help-you-discover-apis/

Further reading on Google operators and the GHDD:

• https://www.googleguide.com/advanced_operators_reference.html
• https://www.exploit-db.com/google-hacking-database
• https://github.com/jakejarvis/awesome-shodan-queries

Further reading on nmap:

• https://nmap.org/book/toc.html
• https://owasp.org/www-pdf-archive/Analysing_Networks_with_NMAP.pdf

Further reading on the interception of data on devices:

• https://approov.io/blog/how-certificate-pinning-helps-thwart-mobile-mitm-attacks
• https://learning.postman.com/docs/sending-requests/capturing-request-data/capturing-http-requests/

Further reading on excessive information exposure:

• https://owasp.org/www-community/Improper_Error_Handling
• https://docs.42crunch.com/latest/content/extras/protection_security_headers.htm

Further reading on...