API Security Misconfiguration (OWASP API8)

Purpose

Test for API-level misconfigurations that expose attack surface, leak information, or enable unauthorized access.

Preconditions

• A mapped API surface
• No requirement for authentication bypass (this tests the CONFIG, not the auth)

Attack Surface Signals

• Verbose error messages in API responses
• Stack traces or framework debug pages
• HTTP 405 responses listing allowed methods
• CORS headers in responses
• OPTIONS/TRACE methods enabled
• Management/monitoring endpoints accessible

Methodology

Verbose Error Testing

# Send malformed requests, look for stack traces, SQL errors, internal paths
curl -sk "https://TARGET/api/nonexistent" | jq .
curl -sk -X POST "https://TARGET/api/users" -H "Content-Type: application/json" -d 'invalid'
curl -sk "https://TARGET/api/users?id=' OR 1=1--" | jq .
curl -sk -H "Content-Type: application/xml" -d '<root>' "https://TARGET/api/users" | head -20

Look for: framework names, versions, file paths, database errors, internal hostnames, stack traces.

Debug/Admin Endpoint Discovery

for path in debug status health metrics actuator actuator/env actuator/heapdump \
  _debug __debug admin console management swagger api-docs v1/api-docs \
  graphql playground graphiql redoc api-docs/swagger.json .env config settings; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://TARGET/$path")
  [ "$code" != "404" ] && [ "$code" != "000" ] && echo "[$code] /$path"
done

Dangerous HTTP Methods

# Check which methods are allowed
curl -sk -X OPTIONS -i "https://TARGET/api/users" | grep -i allow

# Try dangerous methods on endpoints that should only accept GET/POST
for method in PUT DELETE PATCH TRACE TRACK; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" -X $method "https://TARGET/api/users")
  [ "$code" != "405" ] && [ "$code" != "404" ] && echo "[$method] $code"
done