Loading...
Automated security testing for discovering API vulnerabilities
API Fuzzing is an automated security testing technique used to discover vulnerabilities in APIs. It works by sending massive amounts of unexpected, malformed, or random data (payloads) to API endpoints and parameters, then analyzing the responses for errors, crashes, information leaks, or security weaknesses such as input validation failures, injection flaws (SQLi, XSS), authentication/authorization bypass, IDOR, mass assignment, business logic flaws, rate limiting issues, and hidden endpoints or parameters.
Before starting API fuzzing, you need the right tools installed and configured.
Start with simple parameter fuzzing using GET requests. This discovers hidden parameters that may reveal additional functionality or vulnerabilities.
ffuf -u "https://api.target.com/user?id=FUZZ" -w wordlist.txt -mc 200,403ffuf -u "https://api.target.com/search?q=FUZZ" -w wordlist.txt -mc 200ffuf -u "https://api.target.com/item/FUZZ" -w wordlist.txt -mc 200,201,204Discover hidden API endpoints that may not be documented or publicly accessible.
ffuf -u https://api.target.com/FUZZ -w SecLists/Discovery/Web-Content/api-endpoints.txt -mc 200ffuf -u https://api.target.com/api/v1/FUZZ -w wordlist.txt -mc 200,201,204ffuf -u https://api.target.com/FUZZ -w SecLists/Discovery/Web-Content/data-science.txt -mc 200Fuzz POST endpoints with JSON payloads. This is common for authentication and data submission endpoints.
ffuf -u https://api.target.com/login -X POST -H "Content-Type: application/json" -d '{"username":"admin","password":"FUZZ"}' -w passwords.txtffuf -u https://api.target.com/register -X POST -H "Content-Type: application/json" -d '{"email":"FUZZ@test.com","password":"test123"}' -w wordlist.txtffuf -u https://api.target.com/api/submit -X POST -H "Content-Type: application/json" -d '{"data":"FUZZ"}' -w wordlist.txtUse clusterbomb mode to fuzz multiple parameters simultaneously. This is useful for credential stuffing and multi-field testing.
ffuf -mode clusterbomb -u https://api.target.com/login -X POST -d '{"username":"USER","password":"PASS"}' -w users.txt:USER -w passwords.txt:PASS -mc 200ffuf -mode clusterbomb -u https://api.target.com/search -d '{"query":"QUERY","filter":"FILTER"}' -w queries.txt:QUERY -w filters.txt:FILTER -mc 200ffuf -mode clusterbomb -u https://api.target.com/transfer -X POST -d '{"from":"FROM","to":"TO","amount":"AMOUNT"}' -w accounts.txt:FROM -w amounts.txt:AMOUNT -fc 401,403Fuzz HTTP headers to discover authentication bypass, API key exposure, or rate limiting issues.
ffuf -u https://api.target.com/admin -H "Authorization: Bearer FUZZ" -w tokens.txt -mc 200,403ffuf -u https://api.target.com/api -H "X-Api-Key: FUZZ" -w api-keys.txt -mc 200ffuf -u https://api.target.com/user -H "X-Forwarded-For: FUZZ" -w ips.txt -fs 0ffuf -u https://api.target.com/admin -H "X-Admin: FUZZ" -w wordlist.txt -mc 200,403Use recursive scanning to discover nested directories and API paths.
ffuf -u https://api.target.com/FUZZ -w directories.txt -recursion -recursion-depth 3ffuf -u https://api.target.com/FUZZ -w directories.txt -recursion -e .json,.xml,.bakffuf -u https://api.target.com/api/v1/FUZZ -w wordlist.txt -recursion -recursion-depth 2 -mc 200Test with special characters and edge cases to find input validation vulnerabilities.
ffuf -u https://api.target.com/users -X POST -d '{"name":"FUZZ"}' -w SecLists/Fuzzing/big-list-of-naughty-strings.txt -mc 500ffuf -u "https://api.target.com/search?q=FUZZ" -w SecLists/Fuzzing/Injection-SQL.txt -mc 500,400ffuf -u "https://api.target.com/user?name=FUZZ" -w SecLists/Fuzzing/Soft/web-proxies.txt -mc 400,500Discover API subdomains and virtual hosts that may contain different functionality.
ffuf -u https://FUZZ.api.target.com -w subdomains.txt -mc 200ffuf -u https://api.target.com -H "Host: FUZZ" -w vhosts.txt -fs 12345ffuf -u https://FUZZ.target.com -w wordlist.txt -mc 200,403Test SOAP and other XML-based APIs for vulnerabilities.
ffuf -u https://api.target.com/user -X POST -H "Content-Type: application/xml" -d '<user><FUZZ>value</FUZZ></user>' -w fields.txtffuf -u https://api.target.com/soap -X POST -H "Content-Type: application/xml" -d '<?xml version="1.0"?><soap><FUZZ></FUZZ></soap>' -w xml-tags.txtffuf -u https://api.target.com/api -X POST -H "Content-Type: application/xml" -d '<request><FUZZ>test</FUZZ></request>' -w fields.txt -fc 400,500Common flags to enhance your fuzzing commands. Master these for efficient testing.
-t 100-mc 200,201,204,301,403-fs 1234-fw 50-o results.json -of json-x http://127.0.0.1:8080-v-s-rate 50-timeout 10wfuzz is another powerful fuzzer with slightly different syntax. Good alternative for specific scenarios.
wfuzz -c -z file,users.txt -z file,passwords.txt -d "username=FUZZ&password=FUZZ2" --hs "Invalid" https://api.target.com/loginwfuzz -c -z file,parameters.txt -u "https://api.target.com/?FUZZ=1"wfuzz -c -z file,wordlist.txt -u "https://api.target.com/FUZZ" --hc 404wfuzz -c -z file,wordlist.txt -u "https://api.target.com/api/FUZZ" -w highcard.txtFollow these best practices for effective and safe API fuzzing.
-t 100threads-mc 200,403match codes-fs 1234filter size-o out.jsonoutput-x proxyproxy-mode clusterbombmulti-posFor educational and authorized testing purposes only. Always obtain proper authorization before testing.