How to Thinking Like an API Attacker
APIs power modern applications. Over the past few months of testing APIs and working with teams to harden them, one lesson stands out: small mistakes in API design or configuration can lead to major security incidents. The attacks I found weren’t exotic ; they were simple tests that exposed serious weaknesses.
What I observed during testing
- Endpoint enumeration: Using tools like Burp Suite, simple URL manipulation often revealed hidden endpoints and sensitive data. Undocumented or forgotten endpoints are a common blind spot.
- ID-based access control flaws: Changing an ID in a request sometimes returned another user’s data — a clear broken authorization issue.
- SQL injection in API parameters: Weak input validation allowed manipulation of database queries.
- JWT/token issues: Poor token validation, weak signing choices, or incorrect public-key handling allowed token tampering or privilege escalation.
Why this matters
If a security researcher can find these issues, so can a malicious actor. Organizations that avoid external testing (or assume they’re “secure enough”) often leave vulnerabilities undiscovered until exploited. The consequences of a single exploited API vulnerability include:
- Data breaches
- Loss of user trust
- Financial damage
- Long-term reputation harm
Core problems: Authentication, authorization, and endpoint management
The majority of API vulnerabilities I saw fell into these categories:
- Broken Authentication — Weak identity verification enables unauthorized access.
- Broken Authorization — Users can access resources or perform actions they shouldn’t.
- Undocumented / forgotten endpoints — These can bypass normal security controls.
- Poor inventory and management — Not tracking endpoints, permissions, or owners increases exposure.
Concrete examples:
- If changing a user ID in a request grants access to another account, authorization is broken.
- If a token can be modified or verified incorrectly due to bad key handling, authentication is weak.
- A forgotten admin endpoint can give attackers a backdoor into privileged operations.
Threat modeling: think like an attacker
Get Blessing Isaiah’s stories in your inbox
Join Medium for free to get updates from this writer.
Threat modeling helps teams anticipate abuse before release. Before shipping an API, ask:
- What happens if an undocumented endpoint is discovered?
- What happens if a token is manipulated or a signing key is misconfigured?
- What happens if requests are automated at scale (scraping, brute-force)?
Asking these questions early reduces the chance of major incidents later.
Practical controls you should implement
- Use managed identity providers and validation libraries rather than rolling your own token checks.
- For JWTs, prefer RS256/ES256 (asymmetric) and verify public keys are correctly loaded and formatted (PEM, key ID/kid handling). The example above demonstrates successful decoding after correctly loading the public key.
- Maintain an API catalog (Swagger/OpenAPI) and run automated scans against it to discover undocumented endpoints.
- Add a threat-model checklist to your API design document.
- Run an automated security scan and a manual review focusing on authentication/authorization.
- Validate your JWT flows using jwt.io or language-native libraries and ensure key material is loaded exactly as expected.
- Strong authentication
- Use well-vetted token formats (JWTs with RS/ES algorithms) and verify signatures correctly.
- Ensure key rotation and proper key storage (HSM or managed key vault).
- Strict authorization
- Enforce least privilege and perform object-level authorization checks on the server.
- Never trust client-controlled values (IDs, flags) for access decisions.
- Input validation
Validate and sanitize all inputs; use parameterized queries to prevent injection.
- Endpoint inventory & management
Maintain an up-to-date API inventory and remove or secure unused endpoints.
- Rate limiting & abuse controls
Apply per-client and per-endpoint rate limits; detect automation patterns.
- Continuous testing
Run automated security tests, periodic pen tests, and integrate fuzzing/static analysis into CI.
- Logging & monitoring
Log key events (auth failures, high-volume access) and set alerts for abnormal activity.
Final thoughts
Security is a mindset. Designing and operating APIs with an attacker’s perspective reduces risk and protects users and businesses. Focus on strong authentication, strict authorization, thorough input validation, robust endpoint management, and continuous testing. Identify weaknesses before someone else does; secure design builds trust and prevents long-lasting damage.
