API Endpoint Discovery

Hello and welcome back to your training!

In our last lesson, we focused on fingerprinting the web server and its underlying technologies with tools like Wappalyzer and Nikto. That process helps you find known vulnerabilities in common software. Today, we'll dive deeper into the application's unique structure.

This lesson addresses the learning outcome: Enumerate API endpoints by analyzing application traffic and client-side JavaScript files.

Modern web applications are often just a pretty face—a JavaScript-heavy frontend that communicates with a backend Application Programming Interface (API). Finding all the API endpoints, especially those that are hidden or undocumented, is a crucial step in discovering the application's true attack surface. This is where many high-impact bugs are found.

We'll cover two primary methods for this:

1. Passive Enumeration: Analyzing the traffic the application generates during normal use.
2. Active Enumeration: Sifting through the application's client-side code to find endpoints the user interface might not expose.

1. The Low-Hanging Fruit: API Documentation and Traffic Analysis

Before you start digging into code, the first step is always to look for a map. Many organizations provide API documentation to help developers integrate with their services. Finding this documentation can give you a complete list of intended endpoints, parameters, and request structures.

Even without explicit documentation, you can learn a great deal simply by using the application with Burp Suite running. Every action you take—logging in, viewing a profile, adding an item to a cart—sends requests to the backend. These requests reveal the API endpoints responsible for that functionality.

Your workflow for traffic analysis:

1. Configure your browser to proxy through Burp Suite.
2. Navigate through the target application, exercising as much functionality as possible.
3. In Burp Suite, go to the Proxy > HTTP history tab or the Target > Site map tab.
4. Filter for requests that look like API calls. Common patterns include URLs containing /api/, /v1/, /v2/, or ending in .json.
5. Send interesting requests to Burp Repeater (Ctrl+R) to begin manually testing them.

The following video demonstrates this process and shows how to begin interacting with a discovered endpoint.

2. Hunting for Secrets: Finding Endpoints in JavaScript

Traffic analysis only shows you the endpoints the application intends for you to use. The real goldmine for a bug bounty hunter is often in the client-side JavaScript files, which can contain references to:

• Endpoints for features that are still in development.
• Administrative or internal-only endpoints.
• Deprecated but still active endpoints.

Given your background in Computer Science and comfort with reading JavaScript, this is an area where you can excel.

Manual Analysis: The Power of Ctrl+F

The simplest method is to manually review the JavaScript files loaded by the application.

1. Open your browser's Developer Tools and go to the Network tab. Filter by "JS".
2. Reload the page to see all the JavaScript files that are loaded.
3. Open each file (especially large ones like app.js or main.js) in a new tab or in the Sources tab.
4. Use the find function (Ctrl+F) to search for keywords that indicate an endpoint, such as:
   • api/
   • /v1/, /v2/
   • endpoint
   • path:
   • fetch(
   • axios.
   • https:// or http:// (to find absolute URLs)

This manual approach helps you understand the application's logic, but it can be time-consuming.

Automated Analysis: Tools of the Trade

To speed up the process, you can use command-line tools to automate the gathering and analysis of JavaScript files. This is a standard part of any professional's reconnaissance workflow.

As the article describes, a common workflow looks like this:

1. Gather JS File URLs: Use a tool like subjs or gau to collect all known JavaScript file URLs for a target domain.

   # Example using gau to get URLs from the Wayback Machine
   gau example.com | grep '\.js$' > js_files.txt
   

2. Download the Files: Use wget or curl to download all the files from the list.

   # Download all files listed in js_files.txt
   wget -i js_files.txt
   

3. Search for Endpoints: Use grep with a regular expression to extract anything that looks like a path or endpoint from all the downloaded files.

   # A regex to find relative paths in quotes
   grep -Erho '(\"|'\''|`)(\/[^\"'\''`]+)(\"|'\''|`)' *.js | sort -u
   

More advanced tools like LinkFinder are specifically designed for this purpose, combining these steps into one.

The following video showcases a modern, tool-assisted workflow for JavaScript reconnaissance.

function applyDiscount(code) {
  // TODO: move this logic server-side before launch
  if (code === "STAFF50") {
    fetch('/api/v1/cart/apply-coupon', {
      method: 'POST',
      body: JSON.stringify({ coupon: code, discount_percent: 50 })
    });
  } else {
    // Regular coupon logic...
  }
}

// Internal endpoint for price adjustments
// var internalApi = '/api/internal/set-product-price';

Conclusion

You've now learned how to map out an application's API—the very foundation of its functionality and attack surface. By moving beyond what's visible in the user interface and digging into traffic and source code, you've taken a significant step toward thinking like a professional security researcher.

Key Takeaways:

• API Endpoint Enumeration is the process of identifying all possible API endpoints for a target application.
• Start by looking for API documentation and analyzing network traffic in Burp Suite as you browse the application.
• The most valuable findings often come from analyzing client-side JavaScript files for hidden, internal, or unlinked endpoints.
• You can perform JS analysis manually by searching for keywords or automatically by using a toolchain (gau, grep, LinkFinder, etc.) to collect, download, and parse JS files.
• Every discovered endpoint is a new potential entry point for bugs like IDOR, authorization bypasses, and injection attacks.

Next Lesson Preview:
Now that you know how to find API endpoints, the next logical question is: how are they protected? In our next lesson, we will explore how to differentiate between common API authentication patterns like API Keys, Bearer Tokens (JWT), and OAuth. This will equip you to start testing for the authentication flaws we will cover in Module 4.