API Business Flow Abuse (OWASP API6)

Purpose

Identify and exploit API operations that create business value/cost and test whether they can be automated, repeated, or abused beyond their intended human workflow limits.

Preconditions

• A functional API surface with identified state-changing endpoints
• Understanding of what the business does and what operations cost money or resources

Attack Surface Signals

• Coupon/discount/promo code endpoints
• Referral/affiliate/invite endpoints
• OTP/password-reset/SMS/email sending endpoints
• Account creation, free trial, or signup endpoints
• Purchase/booking/reservation endpoints
• Gift card/voucher redemption
• Export/report generation
• Username/email availability checks
• Voting/rating/review endpoints
• Pricing/quote calculators
• Inventory reservation or hold endpoints

Methodology

Step 1: Identify Business-Valuable Operations

Map endpoints that:

• Create or consume monetary value
• Send communications (email/SMS/push)
• Reserve limited resources
• Grant access or privileges
• Generate computational work on the backend

Step 2: Understand the Intended Human Workflow

For each identified operation:

• What is the intended user flow? (e.g., coupon redeemed once at checkout)
• What limits/invariants should hold? (e.g., one coupon per account, one trial per user)
• What is the cost to the business if abused at scale?

Step 3: Test Repeatability

# Coupon: try redeeming the same coupon multiple times
for i in $(seq 1 5); do
  curl -sk -X POST "https://TARGET/api/coupons/redeem" \
    -H "Authorization: Bearer USER_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"code":"WELCOME10"}' | jq -r '.success // .status'
done

# Referral: try claiming the same referral bonus repeatedly
curl -sk -X POST "https://TARGET/api/referrals/claim" \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"referralCode":"ABC123"}'