API Resource Consumption (OWASP API4)

Purpose

Test whether the target's consumption controls (rate limits, size caps, complexity limits, quotas) can be exceeded so that requests keep being processed beyond the established control, enabling brute force, enumeration, and computational-cost abuse.

Preconditions

• Measured baselines: what limits exist and where they trigger
• For concurrency races: parallel request capability (Python asyncio or xargs -P)
• High-volume authorization: the runtime policy governs volume; here we test whether the CONTROL works

Attack Surface Signals

• Rate-limiting headers (429 responses, Retry-After, X-RateLimit-*)
• Endpoints without any visible throttling on expensive operations
• Pagination, search/filter, sort, export/report, batch/bulk, file upload/processing
• Async jobs, streams, subscriptions, WebSocket channels
• Auth endpoints (OTP send, password reset) and availability-check endpoints

Methodology

Step 1: Measure the Baseline

# Find the exact threshold: count requests until 429 (or until behavior changes)
for i in $(seq 1 30); do
  code=$(curl -sk -o /dev/null -w "%{http_code}" -H "Authorization: Bearer TOKEN" \
    "https://TARGET/api/search?q=x")
  echo "$i: $code"
done

Record: threshold N, window, which limit (per-IP, per-account, per-token, per-endpoint), and the absence/presence of headers. Absence of headers proves nothing by itself, measure actual behavior.