⚠️ Authorized testing only. For systems you own or are explicitly permitted to test — labs, CTFs, sanctioned engagements. See Rules of Engagement and Authorization.
Most apps are now thin clients over APIs, and APIs fail differently than web pages — usually at authorization, not injection. The OWASP API Security Top 10 is the map.
The big two
- BOLA / IDOR (Broken Object Level Authorization) — swap an ID and read someone else's object. The #1 API bug. (See XSS, SSRF and IDOR.)
- Broken authentication — weak tokens, no rate limiting, JWT flaws.
Workflow
# enumerate endpoints from a spec
cat openapi.json | jq '.paths | keys[]'
# fuzz an ID parameter for BOLA
ffuf -u https://api/target/users/FUZZ -w ids.txt -H "Authorization: Bearer $TOKEN" -mc 200Drive it through Burp — Autorize auto-tests every request as a low-priv user to catch broken authorization.
JWT checks
| Check | Why |
|---|---|
alg:none accepted? |
Auth bypass |
| Weak HMAC secret? | Forge tokens (Password Cracking) |
| Signature verified at all? | Often not |
Defense: enforce object-level auth on every request, validate JWTs properly, rate-limit. See Securing a Public PHP App.
Related: XSS, SSRF and IDOR · Burp Suite Workflow · Securing a Public PHP App